Professional Documents
Culture Documents
Language: English
of 17 October 2003
Having regard to Regulation (EC) No 1592/2002 of the European Parliament and of the Council of
15 July 2002 on common rules in the field of civil aviation and establishing a European Aviation
Safety Agency1 (hereinafter referred to as the “Basic Regulation”), and in particular Articles 13 and
14 thereof,
Having regard to the Commission Regulation (EC) No 1702/2003 of 24 September 2003 laying
down implementing rules for the airworthiness and environmental certification of aircraft and
related products, parts and appliances, as well as for the certification of design and production
organisations, 2 in particular 21A.16A of Part 21 thereof,
Whereas :
(1) The Agency shall issue certification specifications, including airworthiness codes and
acceptable means of compliance, as well as guidance material to be used in the certification
process.
(2) The Agency has, pursuant to Article 43 of the Basic Regulation, consulted widely interested
parties on the matters which are subject to this Decision and following that consultation
provided a written response to the comments received.
1
OJ L 240, 7.09.2002, p. 1.
2
OJ L 243, 27.09.2003, p. 6.
Article 1
The certification specifications, including airworthiness codes and acceptable means of compliance,
for large aeroplanes are those laid down in the Annex to this Decision.
Article 2
This Decision shall enter into force on 17 October 2003. It shall be published in the Official
Publication of the Agency.
Done at Brussels, 17 October 2003. For the European Aviation Safety Agency,
Patrick GOUDOU
Executive Director
2
European Aviation Safety Agency
Certification Specifications
for
Large Aeroplanes
CS-25
CS-25
CS–25
LARGE AEROPLANES
C-1
CS-25
C-2
CS-25 BOOK 1
CS-25
Book 1
Airworthiness code
1-0-1
BOOK 1 CS-25
1-0-2
BOOK 1 CS–25
SUBPART A – GENERAL
CS 25.1 Applicability
(a) This Airworthiness Code is applicable to
turbine powered Large Aeroplanes.
1–A–1
CS–25 BOOK 1
1–A–2
BOOK 1 CS-25
SUBPART B – FLIGHT
1-B-1
CS-25 BOOK 1
1–B–2
BOOK 1 CS-25
1-B-3
CS-25 BOOK 1
or 2%, whichever is greater, above the speed at deploying speed brakes) to stop the aeroplane
which the device operates. during accelerate-stop tests.
(b) V2MIN, in terms of calibrated airspeed, may
not be less than –
CS 25.105 Take-off
(1) 1·13 VSR for –
(a) The take-off speeds described in CS 25.107,
the accelerate-stop distance described in CS 25.109, (i) Two-engined and three-engined
the take-off path described in CS 25.111, and the turbo-propeller powered aeroplanes; and
take-off distance and take-off run described in CS
(ii) Turbojet powered aeroplanes
25.113, must be determined –
without provisions for obtaining a
(1) At each weight, altitude, and ambient significant reduction in the one-engine-
temperature within the operational limits selected inoperative power-on stall speed;
by the applicant; and
(2) 1·08 VSR for –
(2) In the selected configuration for take-
(i) Turbo-propeller powered
off.
aeroplanes with more than three engines;
(b) No take-off made to determine the data and
required by this paragraph may require exceptional
(ii) Turbojet powered aeroplanes
piloting skill or alertness.
with provisions for obtaining a significant
(c)The take-off data must be based on: reduction in the one-engine-inoperative
power-on stall speed: and
(1) Smooth, dry and wet, hard-surfaced
runways; and (3) 1·10 times VMC established under CS
25.149.
(2) At the option of the applicant,
grooved or porous friction course wet, hard- (c) V2, in terms of calibrated airspeed, must be
surfaced runways. selected by the applicant to provide at least the
gradient of climb required by CS 25.121(b) but may
(d) The take-off data must include, within the
not be less than –
established operational limits of the aeroplane, the
following operational correction factors: (1) V2MIN;
(1) Not more than 50% of nominal wind (2) VR plus the speed increment attained
components along the take-off path opposite to (in accordance with CS 25.111(c)(2)) before
the direction of take-off, and not less than 150% reaching a height of 11 m (35 ft) above the take-
of nominal wind components along the take-off off surface; and
path in the direction of take-off.
(3) A speed that provides the
(2) Effective runway gradients. manoeuvring capability specified in CS 25.143(g).
(d) VMU is the calibrated airspeed at and above
which the aeroplane can safely lift off the ground,
CS 25.107 Take-off speeds
and continue the take-off. VMU speeds must be
(a) V1 must be established in relation to VEF as selected by the applicant throughout the range of
follows: thrust-to-weight ratios to be certificated. These
speeds may be established from free air data if these
(1) VEF is the calibrated airspeed at which
data are verified by ground take-off tests. (See AMC
the critical engine is assumed to fail. VEF must be
25.107(d).)
selected by the applicant, but may not be less than
VMCG determined under CS 25.149 (e). (e) VR, in terms of calibrated air speed, must be
selected in accordance with the conditions of sub-
(2) V1, in terms of calibrated airspeed, is
paragraphs (1) to (4) of this paragraph:
selected by the applicant; however, V1 may not be
less than VEF plus the speed gained with the (1) VR may not be less than –
critical engine inoperative during the time interval
(i) V1;
between the instant at which the critical engine is
failed, and the instant at which the pilot (ii) 105% of VMC;
recognises and reacts to the engine failure, as
(iii) The speed (determined in
indicated by the pilot’s initiation of the first
accordance with CS 25.111(c)(2)) that
action (e.g. applying brakes, reducing thrust,
allows reaching V2 before reaching a height
1–B–4
BOOK 1 CS-25
of 11 m (35 ft) above the take-off surface; (1) 1.18 VSR; and
or
(2) A speed that provides the
(iv) A speed that, if the aeroplane is manoeuvring capability specified in CS25.143(g).
rotated at its maximum practicable rate, will
result in a VLOF of not less than-
(A) 110% of VMU in the all- CS 25.109 Accelerate-stop distance
engines-operating condition,
(a) (See AMC 25.109(a) and (b).) The
and 105% of VMU determined
accelerate-stop distance on a dry runway is the
at the thrust-to-weight ratio
greater of the following distances:
corresponding to the one-
engine-inoperative condition; (1) The sum of the distances necessary to
or –
(B) If the VMU attitude is limited (i) Accelerate the aeroplane from a
by the geometry of the standing start with all engines operating to
aeroplane (i.e., tail contact VEF for take-off from a dry runway;
with the runway), 108% of
(ii) Allow the aeroplane to
VMU in the all-engines-
accelerate from VEF to the highest speed
operating condition and 104%
reached during the rejected take-off,
of VMU determined at the
assuming the critical engine fails at VEF and
thrust-to-weight ratio
the pilot takes the first action to reject the
corresponding to the one-
take-off at the V1 for take-off from a dry
engine-inoperative condition.
runway; and
(See AMC 25.107(e)(1)(iv).)
(iii) Come to a full stop on a dry
(2) For any given set of conditions (such
runway from the speed reached as
as weight, configuration, and temperature), a
prescribed in sub-paragraph (a)(1)(ii) of this
single value of VR, obtained in accordance with
paragraph; plus
this paragraph, must be used to show compliance
with both the one-engine-inoperative and the all- (iv) A distance equivalent to
engines-operating take-off provisions. 2 seconds at the V1 for take-off from a dry
runway.
(3) It must be shown that the one-engine-
inoperative take-off distance, using a rotation (2) The sum of the distances necessary to
speed of 9.3 km/h (5 knots) less than VR –
established in accordance with sub-paragraphs (i) Accelerate the aeroplane from a
(e)(1) and (2) of this paragraph, does not exceed standing start with all engines operating to
the corresponding one-engine-inoperative take-off the highest speed reached during the
distance using the established VR. The take-off rejected take-off, assuming the pilot takes
distances must be determined in accordance with the first action to reject the take-off at the
CS 25.113(a)(1). (See AMC 25.107(e)(3).) V1 for take-off from a dry runway; and
(4) Reasonably expected variations in (ii) With all engines still operating,
service from the established take-off procedures come to a full stop on a dry runway from
for the operation of the aeroplane (such as over- the speed reached as prescribed in sub-
rotation of the aeroplane and out-of-trim paragraph (a)(2)(i) of this paragraph; plus
conditions) may not result in unsafe flight
(iii) A distance equivalent to
characteristics or in marked increases in the
2 seconds at the V1 for take-off from a dry
scheduled take-off distances established in
runway.
accordance with CS 25.113(a). (See AMC No. 1
(b) (See AMC 25.109(a) and (b).) The
to CS25.107 (e) (4) and AMC No. 2 to CS25.107
accelerate-stop distance on a wet runway is the
(e) (4).)
greater of the following distances:
(f) VLOF is the calibrated airspeed at which the
(1) The accelerate-stop distance on a dry
aeroplane first becomes airborne.
runway determined in accordance with sub-
(g) VFTO, in terms of calibrated airspeed, must paragraph (a) of this paragraph; or
be selected by the applicant to provide at least the
(2) The accelerate-stop distance
gradient of climb required by CS 25.121(c), but may
determined in accordance with sub-paragraph (a)
not less less than –
of this paragraph, except that the runway is wet
1-B-5
CS-25 BOOK 1
and the corresponding wet runway values of VEF runway and its efficiency must be determined.
and V1 are used. In determining the wet runway Unless a specific anti-skid system efficiency is
accelerate-stop distance, the stopping force from determined from a quantitative analysis of the
the wheel brakes may never exceed: flight testing on a smooth wet runway, the
maximum tyre-to-ground wet runway braking
(i) The wheel brakes stopping force
coefficient of friction determined in sub-
determined in meeting the requirements of
paragraph (c)(1) of this paragraph must be
CS 25.101(i) and sub-paragraph (a) of this
multiplied by the efficiency value associated with
paragraph; and
the type of anti-skid system installed on the
(ii) The force resulting from the wet aeroplane:
runway braking coefficient of friction
Type of anti-skid system Efficiency value
determined in accordance with sub-
paragraphs (c) or (d) of this paragraph, as On-off 0⋅30
applicable, taking into account the Quasi-modulating 0⋅50
distribution of the normal load between Fully modulating 0⋅80
braked and unbraked wheels at the most
adverse centre of gravity position approved (d) At the option of the applicant, a higher wet
for take-off. runway braking coefficient of friction may be used
(c) The wet runway braking coefficient of for runway surfaces that have been grooved or
friction for a smooth wet runway is defined as a treated with a porous friction course material. For
curve of friction coefficient versus ground speed and grooved and porous friction course runways,
must be computed as follows: (1) 70% of the dry runway braking
(1) The maximum tyre-to-ground wet coefficient of friction used to determine the dry
runway braking coefficient of friction is defined runway accelerate-stop distance; or
as (see Figure 1):
(2) (See AMC 25.109(d)(2).) The wet
where: runway braking coefficient of friction defined in
sub-paragraph (c) of this paragraph, except that a
Tyre Pressure = maximum aeroplane operating
specific anti-skid efficiency, if determined, is
tyre pressure (psi)
appropriate for a grooved or porous friction
µt/gMAX = maximum tyre-to-ground braking course wet runway and the maximum tyre-to-
coefficient ground wet runway braking coefficient of friction
is defined as (see Figure 2):
V = aeroplane true ground speed (knots); and
where:
Linear interpolation may be used for tyre pressures Tyre Pressure = maximum aeroplane operating
other than those listed. tyre pressure (psi)
µ t/gMAX = maximum tyre-to-ground braking
(2) (See AMC 25.109(c)(2) The coefficient
maximum tyre-to-ground wet runway braking V = aeroplane true ground speed (knots); and
coefficient of friction must be adjusted to take Linear interpolation may be used for tyre pressures
into account the efficiency of the anti-skid system other than those listed.
on a wet runway. Anti-skid system operation must
be demonstrated by flight testing on a smooth wet (e) Except as provided in sub-paragraph (f)(1)
of this paragraph, means other than wheel brakes
Tyre Pressure (psi) Maximum Braking Coefficient (tyre-to-ground)
( ) ( ) ( )
3 2
50 V
µ t /gMAX = −0 ⋅ 0350 100 V
+ 0 ⋅ 306 100 V + 0 ⋅ 883
− 0 ⋅ 851 100
Figure 1
1–B–6
BOOK 1 CS-25
= 0 ⋅ 1106( 100 ) − 0 ⋅ 813( 100 ) + 2 ⋅ 13( 100 ) − 2 ⋅ 20( 100 ) + 0 ⋅ 317( 100 )
5 4 3 2
100 µ t /gMAX V V V V V + 0 ⋅ 807
= 0 ⋅ 0498( 100 ) − 0 ⋅ 398( 100 ) + 1⋅ 14( 100 ) − 1⋅ 285( 100 ) + 0 ⋅ 140( 100 )
5 4 3 2
200 µ t /gMAX V V V V V + 0.701
= 0 ⋅ 0314( 100 ) − 0 ⋅ 247( 100 ) + 0 ⋅ 703( 100 ) − 0 ⋅ 779( 100 ) − 0 ⋅ 00954( 100 )
5 4 3 2
300 µ t /gMAX V V V V V + 0 ⋅ 614
Figure 2
1-B-7
CS-25 BOOK 1
(ii) 1·5% for three-engined aero- (b) Take-off distance on a wet runway is the
planes; and greater of –
(iii) 1·7% for four-engined aero- (1) The take-off distance on a dry runway
planes, and determined in accordance with sub-paragraph (a)
of this paragraph; or
(4) Except for gear retraction and
automatic propeller feathering, the aeroplane (2) The horizontal distance along the
configuration may not be changed, and no change take-off path from the start of the take-off to the
in power or thrust that requires action by the pilot point at which the aeroplane is 4,6 m (15 ft) above
may be made, until the aeroplane is 122 m (400 ft) the take-off surface, achieved in a manner
above the take-off surface. consistent with the achievement of V2 before
reaching 11 m (35 ft) above the take-off surface,
(d) The take-off path must be determined by a
determined under CS 25.111 for a wet runway.
continuous demonstrated take-off or by synthesis
(See AMC 113(a)(2), (b)(2) and (c)(2).)
from segments. If the take-off path is determined by
the segmental method – (c) If the take-off distance does not include a
clearway, the take-off run is equal to the take-off
(1) The segments must be clearly defined
distance. If the take-off distance includes a clearway
and must relate to the distinct changes in the
–
configuration, power or thrust, and speed;
(1) The take-off run on a dry runway is
(2) The weight of the aeroplane, the
the greater of –
configuration, and the power or thrust must be
constant throughout each segment and must (i) The horizontal distance along
correspond to the most critical condition the take-off path from the start of the take-
prevailing in the segment; off to a point equidistant between the point
at which VLOF is reached and the point at
(3) The flight path must be based on the
which the aeroplane is 11 m (35 ft) above
aeroplane’s performance without ground effect;
the take-off surface, as determined under CS
and
25.111 for a dry runway; or
(4) The take-off path data must be
(ii) 115% of the horizontal distance
checked by continuous demonstrated take-offs up
along the take-off path, with all engines
to the point at which the aeroplane is out of
operating, from the start of the take-off to a
ground effect and its speed is stabilised, to ensure
point equidistant between the point at which
that the path is conservative to the continuous
VLOF is reached and the point at which the
path.
aeroplane is 11 m (35 ft) above the take-off
The aeroplane is considered to be out of the ground surface, determined by a procedure
effect when it reaches a height equal to its wing span. consistent with CS25.111. (See AMC
25.113(a)(2), (b)(2) and (c)(2).)
(e) Not required for CS–25.
(2) The take-off run on a wet runway is
the greater of –
CS 25.113 Take-off distance and take-off run
(i) The horizontal distance along
(a) Take-off distance on a dry runway is the the take-off path from the start of the take-
greater of – off to the point at which the aeroplane is 4,6
m (15 ft) above the take-off surface,
(1) The horizontal distance along the
achieved in a manner consistent with the
take-off path from the start of the take-off to the
achievement of V2 before reaching 11 m (35
point at which the aeroplane is 11 m (35 ft) above
ft) above the take-off surface, determined
the take-off surface, determined under CS 25.111
under CS 25.111 for a wet runway; or
for a dry runway; or
(ii) 115% of the horizontal distance
(2) 115% of the horizontal distance along
along the take-off path, with all engines
the take-off path, with all engines operating, from
operating, from the start of the take-off to a
the start of the take-off to the point at which the
point equidistant between the point at which
aeroplane is 11 m (35 ft) above the take-off
VLOF is reached and the point at which the
surface, as determined by a procedure consistent
aeroplane is 11 m (35 ft) above the take-off
with CS25.111. (See AMC 25.113(a)(2), (b)(2)
surface, determined by a procedure
and (c)(2).)
consistent with CS 25.111. (See AMC
25.113(a)(2).)
1–B–8
BOOK 1 CS-25
1-B-9
CS-25 BOOK 1
1–B–10
BOOK 1 CS-25
1-B-11
CS-25 BOOK 1
(2)
TAKE-OFF V2 + xx 40° ALL ENGINES OPERATING CLIMB (3)
(1)
A combination of weight, altitude and
temperature (WAT) such that the thrust or power (2) Repeat sub-paragraph (b)(1) of this
setting produces the minimum climb gradient paragraph except initially extend the wing-flaps
specified in CS 25.121 for the flight condition. and then retract them as rapidly as possible. (See
(2)
AMC 25.145(b)(2) and AMC 25.145(b)(1), (b)(2)
Airspeed approved for all-engines-
and (b)(3).)
operating initial climb.
(3) (3) Repeat sub-paragraph (b)(2) of this
That thrust or power setting which, in
the event of failure of the critical engine and without paragraph except at the go-around power or thrust
any crew action to adjust the thrust or power of the setting. (See AMC 25.145(b)(1), (b)(2) and
remaining engines, would result in the thrust or (b)(3).)
power specified for the take-off condition at V2, or (4) With power off, wing-flaps retracted
any lesser thrust or power setting that is used for all-
and the aeroplane trimmed at 1·3 VSR1, rapidly set
engines-operating initial climb procedures.
go-around power or thrust while maintaining the
same airspeed.
(b) With the landing gear extended, no change (2) The landing gear extended; and
in trim control, or exertion of more than 222 N (50
(3) The critical combinations of landing
pounds) control force (representative of the
weights and altitudes.
maximum short term force that can be applied readily
by one hand) may be required for the following (d) Revoked
manoeuvres:
(e) (See AMC 25.145(e).) If gated high-lift
(1) With power off, wing-flaps retracted, device control positions are provided, sub-paragraph
and the aeroplane trimmed at 1·3 VSR1, extend the (c) of this paragraph applies to retractions of the
wing-flaps as rapidly as possible while maintaining high-lift devices from any position from the
the airspeed at approximately 30% above the maximum landing position to the first gated position,
reference stall speed existing at each instant between gated positions, and from the last gated
throughout the manoeuvre. (See AMC 25.145(b)(1), position to the fully retracted position. The
(b)(2) and (b)(3).) requirements of sub-paragraph (c) of this paragraph
also apply to retractions from each approved landing
1-B-12
BOOK 1 CS-25
position to the control position(s) associated with the (1) The critical engine inoperative and its
high-lift device configuration(s) used to establish the propeller (if applicable) in the minimum drag
go-around procedure(s) from that landing position. In position;
addition, the first gated control position from the (2) The remaining engines at maximum
maximum landing position must correspond with a continuous power;
configuration of the high-lift devices used to
establish a go-around procedure from a landing (3) The most unfavourable centre of
configuration. Each gated control position must gravity;
require a separate and distinct motion of the control (4) Landing gear both retracted and
to pass through the gated position and must have extended;
features to prevent inadvertent movement of the
(5) Wing-flaps in the most favourable
control through the gated position. It must only be
climb position; and
possible to make this separate and distinct motion
once the control has reached the gated position. (6) Maximum take-off weight;
(d) Lateral control; roll capability. With the
critical engine inoperative, roll response must allow
CS 25.147 Directional and lateral normal manoeuvres. Lateral control must be
control sufficient, at the speeds likely to be used with one
(a) Directional control; general. (See AMC engine inoperative, to provide a roll rate necessary
25.147(a).) It must be possible, with the wings level, for safety without excessive control forces or travel.
to yaw into the operative engine and to safely make a (See AMC 25.147(d).)
reasonably sudden change in heading of up to 15º in
the direction of the critical inoperative engine. This (e) Lateral control; aeroplanes with four or
must be shown at 1·3 VSR1, for heading changes up to more engines. Aeroplanes with four or more engines
15º (except that the heading change at which the must be able to make 20º banked turns, with and
rudder pedal force is 667 N (150 lbf) need not be against the inoperative engines, from steady flight at
exceeded), and with – a speed equal to 1·3 VSR1, with maximum continuous
power, and with the aeroplane in the configuration
(1) The critical engine inoperative and its prescribed by sub-paragraph (b) of this paragraph.
propeller in the minimum drag position;
(f) Lateral control; all engines operating. With
(2) The power required for level flight at the engines operating, roll response must allow
1.3 VSR1, but not more than maximum continuous normal manoeuvres (such as recovery from upsets
power; produced by gusts and the initiation of evasive
(3) The most unfavourable centre of manoeuvres). There must be enough excess lateral
gravity; control in sideslips (up to sideslip angles that might
be required in normal operation), to allow a limited
(4) Landing gear retracted; amount of manoeuvring and to correct for gusts.
(5) Wing-flaps in the approach position; Lateral control must be enough at any speed up to
and VFC/MFC to provide a peak roll rate necessary for
safety, without excessive control forces or travel.
(6) Maximum landing weight. (See AMC 25.147(f).)
(b) Directional control; aeroplanes with four or
more engines. Aeroplanes with four or more engines
must meet the requirements of sub-paragraph (a) of CS 25.149 Minimum control speed
this paragraph except that – (See AMC 25.149)
(1) The two critical engines must be (a) In establishing the minimum control speeds
inoperative with their propellers (if applicable) in required by this paragraph, the method used to
the minimum drag position; simulate critical engine failure must represent the
most critical mode of powerplant failure with respect
(2) Reserved; and
to controllability expected in service.
(3) The wing-flaps must be in the most
(b) VMC is the calibrated airspeed, at which,
favourable climb position.
when the critical engine is suddenly made
inoperative, it is possible to maintain control of the
(c) Lateral control; general. It must be possible
aeroplane with that engine still inoperative, and
to make 20º banked turns, with and against the
inoperative engine, from steady flight at a speed maintain straight flight with an angle of bank of not
equal to 1·3 VSR1, with – more than 5º.
1-B-13
CS-25 BOOK 1
(c) VMC may not exceed 1·13 VSR with – (2) Maximum available take-off power or
thrust on the operating engines;
(1) Maximum available take-off power or
thrust on the engines; (3) The most unfavourable centre of
gravity;
(2) The most unfavourable centre of
gravity; The aeroplane trimmed for take-off; and
(3) The aeroplane trimmed for take-off; (5) The most unfavourable weight in the
range of take-off weights. (See AMC 25.149(e).)
(4) The maximum sea-level take-off
weight (or any lesser weight necessary to show (f) (See AMC 25.149 (f)) VMCL, the minimum
VMC); control speed during approach and landing with all
engines operating, is the calibrated airspeed at which,
(5) The aeroplane in the most critical
when the critical engine is suddenly made
take-off configuration existing along the flight
inoperative, it is possible to maintain control of the
path after the aeroplane becomes airborne, except
aeroplane with that engine still inoperative, and
with the landing gear retracted;
maintain straight flight with an angle of bank of not
(6) The aeroplane airborne and the more than 5º. VMCL must be established with –
ground effect negligible; and
(1) The aeroplane in the most critical
(7) If applicable, the propeller of the configuration (or, at the option of the applicant,
inoperative engine – each configuration) for approach and landing with
all engines operating;
(i) Windmilling;
(ii) In the most probable position (2) The most unfavourable centre of
for the specific design of the propeller gravity;
control; or
(3) The aeroplane trimmed for approach
(iii) Feathered, if the aeroplane has
with all engines operating;
an automatic feathering device acceptable
for showing compliance with the climb (4) The most unfavourable weight, or, at
requirements of CS 25.121. the option of the applicant, as a function of
weight;
(d) The rudder forces required to maintain
control at VMC may not exceed 667 N (150 lbf) nor (5) For propeller aeroplanes, the propeller
may it be necessary to reduce power or thrust of the of the inoperative engine in the position it
operative engines. During recovery, the aeroplane achieves without pilot action, assuming the engine
may not assume any dangerous attitude or require fails while at the power or thrust necessary to
exceptional piloting skill, alertness, or strength to maintain a 3 degree approach path angle; and
prevent a heading change of more than 20º.
(6) Go-around power or thrust setting on
(e) VMCG, the minimum control speed on the the operating engine(s).
ground, is the calibrated airspeed during the take-off
(g) (See AMC 25.149(g)) For aeroplanes with
run at which, when the critical engine is suddenly
three or more engines, VMCL-2, the minimum control
made inoperative, it is possible to maintain control of
speed during approach and landing with one critical
the aeroplane using the rudder control alone (without
engine inoperative, is the calibrated airspeed at
the use of nose-wheel steering), as limited by 667 N
which, when a second critical engine is suddenly
of force (150 lbf), and the lateral control to the extent
made inoperative, it is possible to maintain control of
of keeping the wings level to enable the take-off to
the aeroplane with both engines still inoperative, and
be safely continued using normal piloting skill. In the
maintain straight flight with an angle of bank of not
determination of VMCG, assuming that the path of the
more than 5º. VMCL-2 must be established with –
aeroplane accelerating with all engines operating is
along the centreline of the runway, its path from the (1) The aeroplane in the most critical
point at which the critical engine is made inoperative configuration (or, at the option of the applicant,
to the point at which recovery to a direction parallel each configuration) for approach and landing with
to the centreline is completed, may not deviate more one critical engine inoperative;
than 9.1 m (30 ft) laterally from the centreline at any
(2) The most unfavourable centre of
point. VMCG must be established, with –
gravity;
(1) The aeroplane in each take-off
(3) The aeroplane trimmed for approach
configuration or, at the option of the applicant, in
with one critical engine inoperative;
the most critical take-off configuration;
1-B-14
BOOK 1 CS-25
(4) The most unfavourable weight, or, at during normally expected conditions of operation
the option of the applicant, as a function of (including operation at any speed from 1·3 VSR1, to
weight; VMO/MMO).
(5) For propeller aeroplanes, the propeller (c) Longitudinal trim. The aeroplane must
of the more critical engine in the position it maintain longitudinal trim during –
achieves without pilot action, assuming the engine
fails while at the power or thrust necessary to (1) A climb with maximum continuous
maintain a 3 degree approach path angle, and the power at a speed not more than 1·3 VSR1, with the
propeller of the other inoperative engine landing gear retracted, and the wing-flaps (i)
feathered; retracted and (ii) in the take-off position;
(6) The power or thrust on the operating (2) Either a glide with power off at a
engine(s) necessary to maintain an approach path speed not more than 1·3 VSR1, or an approach
angle of 3º when one critical engine is within the normal range of approach speeds
inoperative; and appropriate to the weight and configuration with
power settings corresponding to a 3º glidepath,
(7) The power or thrust on the operating
engine(s) rapidly changed, immediately after the whichever is the most severe, with the landing
second critical engine is made inoperative, from gear extended, the wing-flaps retracted and
the power or thrust prescribed in sub-paragraph extended, and with the most unfavourable
(g)(6) of this paragraph to – combination of centre of gravity position and
weight approved for landing; and
(i) Minimum power or thrust; and
(3) Level flight at any speed from
(ii) Go-around power or thrust 1·3 VSR1, to VMO/MMO, with the landing gear and
setting. wing-flaps retracted, and from 1·3 VSR1 to VLE
(h) In demonstrations of VMCL and VMCL-2 – with the landing gear extended.
(1) The rudder force may not exceed 667 (d) Longitudinal, directional, and lateral trim.
N (150 lbf); The aeroplane must maintain longitudinal,
directional, and lateral trim (and for lateral trim, the
(2) The aeroplane may not exhibit
angle of bank may not exceed 5º) at 1·3 VSR1, during
hazardous flight characteristics or require
the climbing flight with –
exceptional piloting skill, alertness or strength;
(3) Lateral control must be sufficient to (1) The critical engine inoperative;
roll the aeroplane, from an initial condition of (2) The remaining engines at maximum
steady straight flight, through an angle of 20º in continuous power; and
the direction necessary to initiate a turn away
from the inoperative engine(s), in not more than 5 (3) The landing gear and wing-flaps
seconds (see AMC 25.149(h)(3)); and retracted.
(4) For propeller aeroplanes, hazardous (e) Aeroplanes with four or more engines. Each
flight characteristics must not be exhibited due to aeroplane with four or more engines must also
any propeller position achieved when the engine maintain trim in rectilinear flight with the most
fails or during any likely subsequent movements unfavourable centre of gravity and at the climb
of the engine or propeller controls (see AMC speed, configuration, and power required by CS
25.149 (h)(4)). 25.123 (a) for the purpose of establishing the en-
route flight path with two engines inoperative.
TRIM
CS 25.161 Trim
(a) General. Each aeroplane must meet the trim
requirements of this paragraph after being trimmed,
and without further pressure upon, or movement of,
either the primary controls or their corresponding
trim controls by the pilot or the automatic pilot.
(b) Lateral and directional trim. The aeroplane
must maintain lateral and directional trim with the
most adverse lateral displacement of the centre of
gravity within the relevant operating limitations,
1-B-15
CS-25 BOOK 1
1-B-16
BOOK 1 CS-25
(ii) Power required for level flight CS 25.177 Static directional and
VMO + 1·3V lateral stability
SR1
at a speed equal to ; and
2 (a) The static directional stability (as shown by
the tendency to recover from a skid with the rudder
(iii) The aeroplane trimmed for level free) must be positive for any landing gear and flap
flight with the power required in sub- position and symmetrical power condition, at speeds
paragraph (ii) above. from 1·13 VSR1, up to VFE, VLE, or VFC/MFC (as
(3) With the landing gear extended, the appropriate).
stick force curve must have a stable slope at all (b) The static lateral stability (as shown by the
speeds within a range which is the greater of 15% tendency to raise the low wing in a sideslip with the
of the trim speed plus the resulting free return aileron controls free) for any landing gear and wing-
speed range or 93 km/h (50 kt) plus the resulting flap position and symmetric power condition, may
free return speed range, above and below the trim not be negative at any airspeed (except that speeds
speed (except that the speed range need not higher than VFE need not be considered for wing-
include speeds less than 1·3 VSR1, nor speeds flaps extended configurations nor speeds higher than
greater than VLE, nor speeds that require a stick VLE for landing gear extended configurations) in the
force of more than 222 N (50 lbf)), with – following airspeed ranges (see AMC 25.177(b)):
(i) Wing-flap, centre of gravity (1) From 1·13 VSR1 to VMO/MMO..
position, and weight as specified in sub-
(2) From VMO/MMO to VFC/MFC, unless
paragraph (b)(1) of this paragraph;
the divergence is –
(ii) The maximum cruising power
selected by the applicant as an operating (i) Gradual;
limitation, except that the power need not (ii) Easily recognisable by the pilot;
exceed that required for level flight at VLE; and
and
(iii) Easily controllable by the pilot
(iii) The aeroplane trimmed for level
(c) In straight, steady, sideslips over the range
flight with the power required in sub-
of sideslip angles appropriate to the operation of the
paragraph (ii) above.
aeroplane, but not less than those obtained with one-
(c) Approach. The stick force curve must have half of the available rudder control input or a rudder
a stable slope at speeds between VSW, and 1·7 VSR1 control force of 801 N (180 lbf) , the aileron and
with – rudder control movements and forces must be
substantially proportional to the angle of sideslip in a
(1) Wing-flaps in the approach position;
stable sense; and the factor of proportionality must
(2) Landing gear retracted; lie between limits found necessary for safe operation
This requirement must be met for the configurations
(3) Maximum landing weight; and and speeds specified in sub-paragraph (a) of this
(4) The aeroplane trimmed at 1·3 VSR1, paragraph. (See AMC 25.177(c).)
with enough power to maintain level flight at this (d) For sideslip angles greater than those
speed. prescribed by sub-paragraph (c) of this paragraph, up
to the angle at which full rudder control is used or a
(d) Landing. The stick force curve must have a rudder control force of 801 N (180 lbf) is obtained,
stable slope and the stick force may not exceed 356 the rudder control forces may not reverse, and
N (80 lbf) at speeds between VSW, and 1·7 VSR0 with – increased rudder deflection must be needed for
(1) Wing-flaps in the landing position; increased angles of sideslip. Compliance with this
(2) Landing gear extended; requirement must be shown using straight, steady
sideslips, unless full lateral control input is achieved
(3) Maximum landing weight; before reaching either full rudder control input or a
(4) The aeroplane trimmed at 1·3 VSR0 rudder control force of 801 N (180 lbf) ; a straight,
with – steady sideslip need not be maintained after
achieving full lateral control input. This requirement
(i) Power or thrust off, and must be met at all approved landing gear and wing-
(ii) Power or thrust for level flight. flap positions for the range of operating speeds and
power conditions appropriate to each landing gear
and wing-flap position with all engines operating.
(See AMC 25.177(d).)
1-B-17
CS-25 BOOK 1
1-B-18
BOOK 1 CS-25
1-B-19
CS-25 BOOK 1
greater, except that it need not exceed 46 km/h (25 gradient in relation to control friction, passenger
kt). movement, levelling off from climb, and descent
from Mach to air speed limit altitudes.
(2) Allowing for pilot reaction time after
MISCELLANEOUS FLIGHT REQUIREMENTS
effective inherent or artificial speed warning
occurs, it must be shown that the aeroplane can be
CS25.251 Vibration and buffeting
recovered to a normal attitude and its speed
(a) The aeroplane must be demonstrated in reduced to VMO/MMO, without –
flight to be free from any vibration and buffeting that
(i) Exceptional piloting strength or
would prevent continued safe flight in any likely
skill;
operating condition.
(ii) Exceeding VD/MD, VDF/MDF, or
(b) Each part of the aeroplane must be
the structural limitations; and
demonstrated in flight to be free from excessive
vibration, under any appropriate speed and power (iii) Buffeting that would impair the
conditions up to VDF/MDF. The maximum speeds pilot’s ability to read the instruments or
shown must be used in establishing the operating control the aeroplane for recovery.
limitations of the aeroplane in accordance with CS
(3) With the aeroplane trimmed at any
25.1505.
speed up to VMO/MMO, there must be no reversal
(c) Except as provided in sub-paragraph (d) of of the response to control input about any axis at
this paragraph, there may be no buffeting condition, any speed up to VDF/MDF. Any tendency to pitch,
in normal flight, including configuration changes roll, or yaw must be mild and readily controllable,
during cruise, severe enough to interfere with the using normal piloting techniques. When the
control of the aeroplane, to cause excessive fatigue to aeroplane is trimmed at VMO/MMO, the slope of the
the crew, or to cause structural damage. Stall warning elevator control force versus speed curve need not
buffeting within these limits is allowable. be stable at speeds greater than VFC/MFC, but there
must be a push force at all speeds up to VDF/MDF
(d) There may be no perceptible buffeting
and there must be no sudden or excessive
condition in the cruise configuration in straight flight
reduction of elevator control force as VDF/MDF is
at any speed up to VMO/MMO, except that the stall
reached.
warning buffeting is allowable.
(4) Adequate roll capability to assure a
(e) For an aeroplane with MD greater than 0·6
prompt recovery from a lateral upset condition
or with a maximum operating altitude greater than
must be available at any speed up to VDF/MDF.
7620 m (25,000 ft), the positive manoeuvring load
(See AMC 25.253(a)(4).)
factors at which the onset of perceptible buffeting
occurs must be determined with the aeroplane in the (5) Extension of speedbrakes. With the
cruise configuration for the ranges of airspeed or aeroplane trimmed at VMO/MMO, extension of the
Mach number, weight, and altitude for which the speedbrakes over the available range of
aeroplane is to be certificated. The envelopes of load movements of the pilots control, at all speeds
factor, speed, altitude, and weight must provide a above VMO/MMO, but not so high that VDF/MDF
sufficient range of speeds and load factors for normal would be exceeded during the manoeuvre, must
operations. Probable inadvertent excursions beyond not result in:
the boundaries of the buffet onset envelopes may not
(i) An excessive positive load factor when
result in unsafe conditions. (See AMC 25.251(e).)
the pilot does not take action to
counteract the effects of extension;
CS 25.253 High-speed characteristics (ii) Buffeting that would impair the pilot’s
ability to read the instruments or control
(a) Speed increase and recovery
the aeroplane for recovery; or
characteristics. The following speed increase and
recovery characteristics must be met: (iii) A nose-down pitching moment, unless
it is small. (See AMC 25.253(a)(5).)
(1) Operating conditions and character-
istics likely to cause inadvertent speed increases (6) Reserved
(including upsets in pitch and roll) must be
(b) Maximum speed for stability characteristics,
simulated with the aeroplane trimmed at any
VFC/MFC. VFC/MFC is the maximum speed at which
likely cruise speed up to VMO/MMO. These
the requirements of CS 25.143(f), 25.147(e),
conditions and characteristics include gust upsets,
25.175(b)(1), 25.177(a) through (c ), and 25.181
inadvertent control movements, low stick force
1-B-20
BOOK 1 CS-25
must be met with wing-flaps and landing gear applicable limit specified in sub-paragraph (c)(1) of
retracted. It may not be less than a speed midway this paragraph.
between VMO/MMO and VDF/MDF, except that, for
(e) During flight tests required by sub-
altitudes where Mach Number is the limiting factor,
paragraph (a) of this paragraph the limit manoeuvring
MFC need not exceed the Mach Number at which
load factors prescribed in CS25.333 (b) and 25.337,
effective speed warning occurs.
and the manoeuvring load factors associated with
probable inadvertent excursions beyond the
boundaries of the buffet onset envelopes determined
CS 25.255 Out-of-trim characteristics
under CS 25.251 (e), need not be exceeded. In
(See AMC 25.255)
addition, the entry speeds for flight test
(a) From an initial condition with the aeroplane demonstrations at normal acceleration values less
trimmed at cruise speeds up to VMO/MMO, the than 1 g must be limited to the extent necessary to
aeroplane must have satisfactory manoeuvring accomplish a recovery without exceeding VDF/MDF.
stability and controllability with the degree of out-of-
(f) In the out-of-trim condition specified in
trim in both the aeroplane nose-up and nose-down
sub-paragraph (a) of this paragraph, it must be
directions, which results from the greater of –
possible from an overspeed condition at VDF/MDF, to
(1) A three-second movement of the produce at least 1·5 g for recovery by applying not
longitudinal trim system at its normal rate for the more than 556 N (125 lbf) of longitudinal control
particular flight condition with no aerodynamic force using either the primary longitudinal control
load (or an equivalent degree of trim for alone or the primary longitudinal control and the
aeroplanes that do not have a power-operated trim longitudinal trim system. If the longitudinal trim is
system), except as limited by stops in the trim used to assist in producing the required load factor, it
system, including those required by CS25.655 (b) must be shown at VDF/MDF that the longitudinal trim
for adjustable stabilisers; or can be actuated in the aeroplane nose-up direction
with the primary surface loaded to correspond to the
(2) The maximum mistrim that can be
least of the following aeroplane nose-up control
sustained by the autopilot while maintaining level
forces:
flight in the high speed cruising condition.
(1) The maximum control forces expected
(b) In the out-of-trim condition specified in
in service as specified in CS 25.301 and 25.397.
sub-paragraph (a) of this paragraph, when the normal
acceleration is varied from + 1 g to the positive and (2) The control force required to produce
negative values specified in sub-paragraph (c) of this 1·5 g.
paragraph –
(3) The control force corresponding to
(1) The stick force vs. g curve must have buffeting or other phenomena of such intensity
a positive slope at any speed up to and including that it is a strong deterrent to further application
VFC/MFC; and of primary longitudinal control force.
(2) At speeds between VFC/MFC and
VDF/MDF, the direction of the primary longitudinal
control force may not reverse.
(c) Except as provided in sub-paragraphs (d)
and (e) of this paragraph compliance with the
provisions of sub-paragraph (a) of this paragraph
must be demonstrated in flight over the acceleration
range –
(1) –1g to 2·5 g; or
(2) 0 g to 2·0 g, and extrapolating by an
acceptable method to – 1 g and 2·5 g.
(d) If the procedure set forth in sub-paragraph
(c)(2) of this paragraph is used to demonstrate
compliance and marginal conditions exist during
flight test with regard to reversal of primary
longitudinal control force, flight tests must be
accomplished from the normal acceleration at which
a marginal condition is found to exist to the
1-B-21
CS-25 BOOK 1
1-B-22
SUBPART C – STRUCTURE
1-C-1
CS -25 BOOK 1
appropriate to each particular flight load obtain extreme nose up pitching acceleration. In
condition; and defining the tail load, the response of the
aeroplane must be taken into account. Aeroplane
(3) For each required altitude and weight,
loads which occur subsequent to the time when
for any practicable distribution of disposable load
normal acceleration at the c.g. exceeds the
within the operating limitations recorded in the
positive limit manoeuvring load factor (at point
Aeroplane Flight Manual.
A2 in CS.333(b)), or the resulting tailplane normal
(c) Enough points on and within the boundaries load reaches its maximum, whichever occurs first,
of the design envelope must be investigated to ensure need not be considered.
that the maximum load for each part of the aeroplane
(2) Checked manoeuvre between VA and
structure is obtained.
VD. Nose up checked pitching manoeuvres must
(d) The significant forces acting on the be analysed in which the positive limit load
aeroplane must be placed in equilibrium in a rational factor prescribed in CS 25.337 is achieved. As
or conservative manner. The linear inertia forces a separate condition, nose down checked
must be considered in equilibrium with the thrust and pitching manoeuvres must be analysed in which
all aerodynamic loads, while the angular (pitching) a limit load factor of 0 is achieved. In defining
inertia forces must be considered in equilibrium with the aeroplane loads the cockpit pitch control
thrust and all aerodynamic moments, including motions described in sub-paragraphs (i), (ii),
moments due to loads on components such as tail (iii) and (iv) of this paragraph must be used:
surfaces and nacelles. Critical thrust values in the
(i) The aeroplane is assumed to be
range from zero to maximum continuous thrust must
flying in steady level flight at any speed
be considered.
between VA and VD and the cockpit pitch
control is moved in accordance with the
following formula:
FLIGHT MANOEUVRE AND GUST CONDITIONS
1-C-2
πV (iv) In cases where the cockpit pitch
ω= control motion may be affected by inputs
2V A radians per second; from systems (for example, by a stick
pusher that can operate at high load factor
where:
as well as at 1g) then the effects of those
V = the speed of the aeroplane at systems must be taken into account.
entry to the manoeuvre.
(v) Aeroplane loads that occur
VA = the design manoeuvring beyond the following times need not be
speed prescribed in considered:
CS 25.335(c)
(A) For the nose-up pitching
(ii) For nose-up pitching manoeuvre, the time at which the
manoeuvres the complete cockpit pitch normal acceleration at the c.g. goes
control displacement history may be below 0g;
scaled down in amplitude to the extent
(B) For the nose-down
just necessary to ensure that the positive
pitching manoeuvre, the time at
limit load factor prescribed in CS 25.337
which the normal acceleration at the
is not exceeded. For nose-down pitching
c.g. goes above the positive limit
manoeuvres the complete cockpit control
load factor prescribed in CS 25.337;
displacement history may be scaled down
in amplitude to the extent just necessary (C) tmax.
to ensure that the normal acceleration at
the c.g. does not go below 0g.
CS 25.333 Flight manoeuvring
(iii) In addition, for cases where the envelope
aeroplane response to the specified
(a) General. The strength requirements must be
cockpit pitch control motion does not
met at each combination of airspeed and load factor
achieve the prescribed limit load factors
on and within the boundaries of the representative
then the following cockpit pitch control
manoeuvring envelope (V-n diagram) of sub-
motion must be used:
paragraph (b) of this paragraph. This envelope must
δ(t) = δ1 sin(ωt) for 0 ≤ t ≤ t1 also be used in determining the aeroplane structural
operating limitations as specified in CS 25.1501.
δ(t) = δ1 for t1 ≤ t ≤ t2
δ(t) = δ1 sin(ω[t + t1 - t2]) for t2 ≤ t ≤ tmax
where:
t1 = π/2ω
t2 = t1 + ∆t
tmax = t2 + π/ω;
∆t = the minimum period of time
necessary to allow the
prescribed limit load factor to
be achieved in the initial
direction, but it need not
exceed five seconds (see INTENTIONALLY LEFT BLANK
figure below).
Cockpit Control
δ1
deflection
δ ∆t tmax time
t1 t2
−δ 1
1-C-3
CS -25 BOOK 1
1-C-4
(ii) VS1 is the stalling speed with (1) The design wing-flap speed for each
wing-flaps retracted. wing-flap position (established in accordance with
CS 25.697 (a)) must be sufficiently greater than
(2) VA and VS must be evaluated at the
the operating speed recommended for the
design weight and altitude under consideration.
corresponding stage of flight (including balked
(3) VA need not be more than VC or the landings) to allow for probable variations in
speed at which the positive CNmax curve intersects control of airspeed and for transition from one
the positive manoeuvre load factor line, whichever wing-flap position to another.
is less.
(2) If an automatic wing-flap positioning or
(d) Design speed for maximum gust intensity, load limiting device is used, the speeds and
VB. corresponding wing-flap positions programmed or
allowed by the device may be used.
(1) VB may not be less than
(3) VF may not be less than –
1
K g U ref Vc a 2
Vs1 1 + (i) 1·6 VS1 with the wing-flaps in
498w
take-off position at maximum take-off
where – weight;
(ii) 1·8 VS1 with the wing-flaps in
Vsl = the 1-g stalling speed based on CNAmax
approach position at maximum landing
with the flaps retracted at the particular weight under
weight; and
consideration;
(iii) 1·8 VS0 with the wing-flaps in
CNAmax = the maximum aeroplane normal force
landing position at maximum landing
coefficient;
weight.
Vc = design cruise speed (knots equivalent
(f) Design drag device speeds, VDD. The
airspeed);
selected design speed for each drag device must be
Uref = the reference gust velocity (feet per sufficiently greater than the speed recommended for
second equivalent airspeed) from CS 25.341(a)(5)(i); the operation of the device to allow for probable
variations in speed control. For drag devices
w = average wing loading (pounds per
intended for use in high speed descents, VDD may not
square foot) at the particular weight
be less than VD. When an automatic drag device
under consideration.
positioning or load limiting means is used, the speeds
.88µ and corresponding drag device positions programmed
Kg =
5.3 + µ or allowed by the automatic means must be used for
design.
2w
µ =
ρ cag
CS 25.337 Limit manoeuvring load
ρ = density of air (slugs/ft3); factors
(See AMC 25.337)
c = mean geometric chord of the wing
(feet); (a) Except where limited by maximum (static)
2 lift coefficients, the aeroplane is assumed to be
g = acceleration due to gravity (ft/sec );
subjected to symmetrical manoeuvres resulting in the
a = slope of the aeroplane normal force limit manoeuvring load factors prescribed in this
coefficient curve, CNA per radian; paragraph. Pitching velocities appropriate to the
corresponding pull-up and steady turn manoeuvres
(2) At altitudes where Vc is limited by
must be taken into account.
Mach number –
(b) The positive limit manoeuvring load factor
(i) VB may be chosen to provide an
‘n’ for any speed up to VD may not be less than 2·1 +
optimum margin between low and high
24 000
speed buffet boundaries; and, except that ‘n’ may not be less than
W + 10 000
(ii) VB need not be greater than VC.
2·5 and need not be greater than 3·8 – where ‘W’ is
(e) Design wing-flap speeds, VF. For VF, the the design maximum take-off weight (lb).
following apply:
(c) The negative limit manoeuvring load factor
–
1-C-5
CS -25 BOOK 1
(1) May not be less than –1·0 at speeds up (5) The following reference gust
to VC; and velocities apply:
(2) Must vary linearly with speed from (i) At the aeroplane design speed
the value at VC to zero at VD. VC: Positive and negative gusts with reference
gust velocities of 17.07 m/s (56·0 ft/s) EAS
(d) Manoeuvring load factors lower than those
must be considered at sea level. The reference
specified in this paragraph may be used if the
gust velocity may be reduced linearly from
aeroplane has design features that make it impossible
to exceed these values in flight. 17.07 m/s (56·0 ft/s) EAS at sea level to
13.41 m/s (44·0 ft/s) EAS at 4572 m
(15 000 fet). The reference gust velocity may
CS 25.341 Gust and turbulence loads be further reduced linearly from 13.41 m/s
(44·0 ft/s) EAS at 4572 m (15 000 fet) to
(a) Discrete Gust Design Criteria. The
7.92 m/sec (26·0 ft/sc) EAS at 15240m (50
aeroplane is assumed to be subjected to symmetrical
000 ft).
vertical and lateral gusts in level flight. Limit gust
loads must be determined in accordance with the (ii) At the aeroplane design speed
following provisions: VD: The reference gust velocity must be
0·5 times the value obtained under CS
(1) Loads on each part of the structure
25.341(a)(5)(i).
must be determined by dynamic analysis. The
analysis must take into account unsteady (6) The flight profile alleviation factor,
aerodynamic characteristics and all significant Fg, must be increased linearly from the sea level
structural degrees of freedom including rigid body value to a value of 1.0 at the maximum operating
motions. altitude defined in CS 25.1527. At sea level, the
flight profile alleviation factor is determined by
(2) The shape of the gust must be taken as
the following equation.
follows:
U ds π s
1 − cos
U= for 0 ≤ s ≤ 2H Fg = 0·5 (Fgz + Fgm)
2 H where –
U = 0 for s > 2H
Zmo ; Zmo
where – Fgz = 1 − (Fgz = 1 − )
s = distance penetrated into the gust (metre 76200 250 000
);
Uds = the design gust velocity in equivalent Fgm= R 2 Tan π R 1 ;
4
airspeed specified in sub-paragraph (a) (4)
Maximum Landing Weight
of this paragraph; R1 = ;
Maximum Take - off Weight
H = the gust gradient which is the distance
(metre) parallel to the aeroplane’s flight
Maximum Zero Fuel Weight
path for the gust to reach its peak R2 = ;
Maximum Take - off Weight
velocity.
Zmo maximum operating altitude (metres (feet))
(3) A sufficient number of gust gradient
defined in CS 25.1527.
distances in the range 9 m (30 feet) to 107 m (350
feet) must be investigated to find the critical
response for each load quantity. (7) When a stability augmentation system
is included in the analysis, the effect of any
(4) The design gust velocity must be: significant system non-linearities should be
U ds = U ref Fg H ( 350
) 1
6
accounted for when deriving limit loads from
limit gust conditions.
where – (b) Continuous Gust Design Criteria. The
Uref = the reference gust velocity in equivalent dynamic response of the aeroplane to vertical and
airspeed defined in sub-paragraph (a)(5) lateral continuous turbulence must be taken into
of this paragraph; account. (See AMC 25.341 (b).)
Fg = the flight profile alleviation factor
defined in sub-paragraph (a)(6) of this
paragraph.
1-C-6
c = mean geometric chord of the wing (metres
(feet)).
CS 25.343 Design fuel and oil loads
(b) The aeroplane must be designed for the
(a) The disposable load combinations must conditions prescribed in sub-paragraph (a) of this
include each fuel and oil load in the range from zero paragraph except that the aeroplane load factor need
fuel and oil to the selected maximum fuel and oil not exceed 1·0, taking into account, as separate
load. A structural reserve fuel condition, not conditions, the effects of –
exceeding 45 minutes of fuel under operating
(1) Propeller slipstream corresponding to
conditions in CS 25.1001 (f), may be selected.
maximum continuous power at the design flap
(b) If a structural reserve fuel condition is speeds VF, and with take-off power at not less
selected, it must be used as the minimum fuel weight than 1·4 times the stalling speed for the particular
condition for showing compliance with the flight flap position and associated maximum weight; and
load requirements as prescribed in this Subpart. In
(2) A head-on gust of 7.62m/sec (25 fps)
addition –
velocity (EAS).
(1) The structure must be designed for a
(c) If flaps or other high lift devices are to be
condition of zero fuel and oil in the wing at limit
used in en-route conditions, and with flaps in the
loads corresponding to –
appropriate position at speeds up to the flap design
(i) A manoeuvring load factor of speed chosen for these conditions, the aeroplane is
+2·25; and assumed to be subjected to symmetrical manoeuvres
and gusts within the range determined by –
(ii) The gust conditions of CS
25.341 (a), but assuming 85% of the design (1) Manoeuvring to a positive limit load
velocities prescribed in CS 25.341(a)(4). factor as prescribed in CS 25.337 (b); and
(2) Fatigue evaluation of the structure (2) The discrete vertical gust criteria in
must account for any increase in operating CS 25.341 (a). (See AMC 25.345 (c).)
stresses resulting from the design condition of
(d) The aeroplane must be designed for a
sub-paragraph (b) (1) of this paragraph; and
manoeuvring load factor of 1.5 g at the maximum
(3) The flutter, deformation, and vibration take-off weight with the wing-flaps and similar high
requirements must also be met with zero fuel. lift devices in the landing configurations.
1-C-7
CS -25 BOOK 1
angular acceleration conditions, zero rolling maximum rudder deflection available within the
velocity may be assumed in the absence of a limitations specified in sub-paragraph (a) of this
rational time history investigation of the paragraph.
manoeuvre.
(d) With the aeroplane yawed to the static
(2) At VA, a sudden deflection of the equilibrium sideslip angle of sub-paragraph (c) of
aileron to the stop is assumed. this paragraph, it is assumed that the cockpit rudder
control is suddenly returned to neutral.
(3) At VC, the aileron deflection must be
that required to produce a rate of roll not less than
that obtained in sub-paragraph (a) (2) of this SUPPLEMENTARY CONDITIONS
paragraph.
CS 25.361 Engine and APU torque
(4) At VD, the aileron deflection must be
(a) Each engine mount and its supporting
that required to produce a rate of roll not less than
structures must be designed for engine torque effects
one-third of that in sub-paragraph (a) (2) of this
combined with –
paragraph.
(1) A limit engine torque corresponding
(b) Unsymmetrical gusts. The aeroplane is
to take-off power and propeller speed acting
assumed to be subjected to unsymmetrical vertical
simultaneously with 75% of the limit loads from
gusts in level flight. The resulting limit loads must
flight condition A of CS 25.333 (b);
be determined from either the wing maximum airload
derived directly from CS 25.341(a), or the wing (2) A limit engine torque as specified in
maximum airload derived indirectly from the vertical sub-paragraph (c) of this paragraph acting
load factor calculated from CS 25.341(a). It must be simultaneously with the limit loads from flight
assumed that 100 percent of the wing airload acts on condition A of CS 25.333 (b); and
one side of the aeroplane and 80 percent of the wing
(3) For turbo-propeller installations, in
airload acts on the other side.
addition to the conditions specified in sub-
paragraphs (a) (1) and (2) of this paragraph, a
limit engine torque corresponding to take-off
CS 25.351 Yaw manoeuvre conditions
power and propeller speed, multiplied by a factor
The aeroplane must be designed for loads resulting accounting for propeller control system
from the yaw manoeuvre conditions specified in sub- malfunction, including quick feathering, acting
paragraphs (a) through (d) of this paragraph at speeds simultaneously with 1 g level flight loads. In the
from VMC to VD. Unbalanced aerodynamic moments absence of a rational analysis, a factor of 1·6 must
about the centre of gravity must be reacted in a be used.
rational or conservative manner considering the
(b) For turbine engines and auxiliary power unit
aeroplane inertia forces. In computing the tail loads
installations, the limit torque load imposed by sudden
the yawing velocity may be assumed to be zero.
stoppage due to malfunction or structural failure
(a) With the aeroplane in unaccelerated flight at (such as a compressor jamming) must be considered
zero yaw, it is assumed that the cockpit rudder in the design of engine and auxiliary power unit
control is suddenly displaced to achieve the resulting mounts and supporting structure. In the absence of
rudder deflection, as limited by: better information a sudden stoppage must be
assumed to occur in 3 seconds.
(1) the control system or control surface
stops; or (c) The limit engine torque to be considered
under sub-paragraph (a) (2) of this paragraph is
(2) a limit pilot force of 1335 N (300 lbf)
obtained by multiplying the mean torque by a factor
from VMC to VA and 890 N (200 lbf) from VC/MC
of 1·25 for turbo-propeller installations.
to VD/MD, with a linear variation between VA and
VC/MC. (d) When applying CS 25.361 (a) to turbo-jet
engines, the limit engine torque must be equal to
(b) With the cockpit rudder control deflected so
the maximum accelerating torque for the case
as always to maintain the maximum rudder deflection
considered. (See AMC 25.301 (b).)
available within the limitations specified in sub-
paragraph (a) of this paragraph, it is assumed that the
aeroplane yaws to the overswing sideslip angle.
(c) With the aeroplane yawed to the static
equilibrium sideslip angle, it is assumed that the
cockpit rudder control is held so as to achieve the
1-C-8
both considered as a single compartment for
openings that cannot reasonably be expected to be
CS 25.363 Side load on engine and confined to the small compartment. The size Ho
auxiliary power unit must be computed by the following formula:
mounts
Ho = PAs
(a) Each engine and auxiliary power unit mount
where,
and its supporting structure must be designed for a
Ho = maximum opening in square feet, need
limit load factor in a lateral direction, for the side
not exceed 20 square feet.
load on the engine and auxiliary power unit mount, at
As
least equal to the maximum load factor obtained in P = + ⋅024
the yawing conditions but not less than – 6240
As = maximum cross sectional area of the
(1) 1·33; or pressurised shell normal to the longitudinal axis,
(2) One-third of the limit load factor for in square feet; and
flight condition A as prescribed in CS 25.333 (b). (3) The maximum opening caused by
aeroplane or equipment failures not shown to be
(b) The side load prescribed in sub-paragraph extremely improbable. (See AMC 25.365 (e).)
(a) of this paragraph may be assumed to be
independent of other flight conditions. (f) In complying with sub-paragraph (e) of this
paragraph, the fail-safe features of the design may be
considered in determining the probability of failure
CS 25.365 Pressurised compartment or penetration and probable size of openings,
loads provided that possible improper operation of closure
devices and inadvertent door openings are also
For aeroplanes with one or more pressurised considered. Furthermore, the resulting differential
compartments the following apply: pressure loads must be combined in a rational and
(a) The aeroplane structure must be strong conservative manner with 1 g level flight loads and
enough to withstand the flight loads combined with any loads arising from emergency depressurisation
pressure differential loads from zero up to the conditions. These loads may be considered as
maximum relief valve setting. ultimate conditions; however, any deformation
associated with these conditions must not interfere
(b) The external pressure distribution in flight, with continued safe flight and landing. The pressure
and stress concentrations and fatigue effects must be relief provided by the intercompartment venting may
accounted for. also be considered.
(c) If landings may be made with the (g) Bulkheads, floors, and partitions in
compartment pressurised, landing loads must be pressurised compartments for occupants must be
combined with pressure differential loads from zero designed to withstand conditions specified in sub-
up to the maximum allowed during landing. paragraph (e) of this paragraph. In addition,
(d) The aeroplane structure must be strong reasonable design precautions must be taken to
enough to withstand the pressure differential loads minimise the probability of parts becoming detached
corresponding to the maximum relief valve setting and injuring occupants while in their seats.
multiplied by a factor of 1·33, omitting other loads.
(e) Any structure, component or part, inside or CS 25.367 Unsymmetrical loads due
outside a pressurised compartment, the failure of to engine failure
which could interfere with continued safe flight and
landing, must be designed to withstand the effects of (a) The aeroplane must be designed for the
a sudden release of pressure through an opening in unsymmetrical loads resulting from the failure of the
any compartment at any operating altitude resulting critical engine. Turbo-propeller aeroplanes must be
from each of the following conditions: designed for the following conditions in combination
with a single malfunction of the propeller drag
(1) The penetration of the compartment by limiting system, considering the probable pilot
a portion of an engine following an engine corrective action on the flight controls:
disintegration.
(1) At speeds between VMC and VD, the
(2) Any opening in any pressurised loads resulting from power failure because of fuel
compartment up to the size Ho in square feet; flow interruption are considered to be limit loads.
however, small compartments may be combined
with an adjacent pressurised compartment and
1-C-9
CS -25 BOOK 1
1-C-10
conditions) and to be reacted at the attachment of the (b) The control system must be designed for
control system to the control surface horn. pilot forces applied in the same direction, using
individual pilot forces not less than 0·75 times those
(b) Pilot effort effects. In the control surface
obtained under CS 25.395.
flight loading condition, the air loads on movable
surfaces and the corresponding deflections need not
exceed those that would result in flight from the
CS 25.405 Secondary control system
application of any pilot force within the ranges
specified in sub-paragraph (c) of this paragraph. Secondary controls, such as wheel brake, spoiler, and
Two-thirds of the maximum values specified for the tab controls, must be designed for the maximum
aileron and elevator may be used if control surface forces that a pilot is likely to apply to those controls.
hinge moments are based on reliable data. In The following values may be used:
applying this criterion, the effects of servo PILOT CONTROL FORCE LIMITS (SECONDARY
mechanisms, tabs, and automatic pilot systems, must CONTROLS).
be considered.
Control Limit pilot forces
(c) Limit pilot forces and torques. The limit
pilot forces and torques are as follows: Miscellaneous: 1+ R
x 222 N (50 lbf),
*Crank, wheel, or 3
Maximum Minimum lever. but not less than 222 N (50
Control forces or forces or lbf) nor more than
torques torques 667 N (150 lbf)
(R = radius).
Aileron: (Applicable to any angle
Stick 445 N (100 lbf) 178 N (40 lbf) within 20º of plane of
Wheel* 356 DNm (80 D 178 DNm (40 D control).
in.lb)** in.lbf)
Twist 15 Nm (133 in.lbf)
Elevator:
Stick 1112 N (250 445 N (100 lbf) Push-pull To be chosen by applicant.
lbf) *Limited to flap, tab, stabiliser, spoiler, and landing gear
Wheel (symmetrical)
operation controls.
1335N(300 lbf) 445 N(100 lbf)
Wheel 445 N
(unsymmetrical)† (100 lbf) CS 25.407 Trim tab effects
Rudder 1335 N (300 578 N The effects of trim tabs on the control surface design
lbf) 130 lbf conditions must be accounted for only where the
surface loads are limited by maximum pilot effort. In
*The critical parts of the aileron control system must be
these cases, the tabs are considered to be deflected in
designed for a single tangential force with a limit value equal
the direction that would assist the pilot, and the
to 1·25 times the couple force determined from these criteria.
deflections are –
**D = wheel diameter in m (inches) (a) For elevator trim tabs, those required to trim
†The unsymmetrical forces must be applied at one of the the aeroplane at any point within the positive portion
normal handgrip points on the periphery of the control of the pertinent flight envelope in CS 25.333 (b),
wheel. except as limited by the stops; and
(b) For aileron and rudder trim tabs, those
CS 25.399 Dual control system required to trim the aeroplane in the critical
unsymmetrical power and loading conditions, with
(a) Each dual control system must be designed appropriate allowance for rigging tolerances.
for the pilots operating in opposition, using
individual pilot forces not less than –
(1) 0·75 times those obtained under JAR CS 25.409 Tabs
25.395; or (a) Trim tabs. Trim tabs must be designed to
(2) The minimum forces specified in CS withstand loads arising from all likely combinations
25.397 (c). of tab setting, primary control position, and
aeroplane speed (obtainable without exceeding the
1-C-11
CS -25 BOOK 1
1-C-12
cockpit controls must be designed to the resultant (1) 100% to the area of the vertical
limit loads, except that the parts of the control surfaces above (or below) the horizontal surface.
system where loads are eventually reacted by the
(2) 80% to the area below (or above) the
pilot need not exceed:
horizontal surface.
(i) The loads corresponding to the
maximum pilot loads in CS 25.397(c) for
each pilot alone; or CS 25.457 Wing-flaps
(ii) 0.75 times these maximum Wing flaps, their operating mechanisms, and their
loads for each pilot when the pilot forces are supporting structures must be designed for critical
applied in the same direction loads occurring in the conditions prescribed in CS
25.345, accounting for the loads occurring during
transition from one wing-flap position and airspeed
CS 25.427 Unsymmetrical loads to another.
(a) In designing the aeroplane for lateral gust,
yaw manoeuvre and roll manoeuvre conditions,
account must be taken of unsymmetrical loads on the CS 25.459 Special devices
empennage arising from effects such as slipstream The loading for special devices using aero-dynamic
and aerodynamic interference with the wing, vertical surfaces (such as slots, slats and spoilers) must be
fin and other aerodynamic surfaces. determined from test data.
(b) The horizontal tail must be assumed to be
subjected to unsymmetrical loading conditions GROUND LOADS
determined as follows:
CS 25.471 General
(1) 100% of the maximum loading from
the symmetrical manoeuvre conditions of CS (a) Loads and equilibrium. For limit ground
25.331 and the vertical gust conditions of CS loads –
25.341(a) acting separately on the surface on one (1) Limit ground loads obtained under
side of the plane of symmetry; and this Subpart are considered to be external forces
(2) 80% of these loadings acting on the applied to the aeroplane structure; and
other side. (2) In each specified ground load
(c) For empennage arrangements where the condition, the external loads must be placed in
horizontal tail surfaces have dihedral angles greater equilibrium with the linear and angular inertia
than plus or minus 10 degrees, or are supported by loads in a rational or conservative manner.
the vertical tail surfaces, the surfaces and the (b) Critical centres of gravity. The critical
supporting structure must be designed for gust centres of gravity within the range for which
velocities specified in CS 25.341(a) acting in any certification is requested must be selected so that the
orientation at right angles to the flight path. maximum design loads are obtained in each landing
gear element. Fore and aft, vertical, and lateral
aeroplane centres of gravity must be considered.
CS 25.445 Outboard fins Lateral displacements of the centre of gravity from
(a) When significant, the aerodynamic the aeroplane centreline which would result in main
influence between auxiliary aerodynamic surfaces, gear loads not greater than 103% of the critical
such as outboard fins and winglets, and their design load for symmetrical loading conditions may
supporting aerodynamic surfaces must be taken into be selected without considering the effects of these
account for all loading conditions including pitch, lateral centre of gravity displacements on the loading
roll and yaw manoeuvres, and gusts as specified in of the main gear elements, or on the aeroplane
CS 25.341(a) acting at any orientation at right angles structure provided –
to the flight path. (1) The lateral displacement of the centre
(b) To provide for unsymmetrical loading when of gravity results from random passenger or cargo
outboard fins extend above and below the horizontal disposition within the fuselage or from random
surface, the critical vertical surface loading (load per unsymmetrical fuel loading or fuel usage; and
unit area) determined under CS 25.391 must also be (2) Appropriate loading instructions for
applied as follows: random disposable loads are included under the
provisions of CS 25.1583 (c) (1) to ensure that
1-C-13
CS -25 BOOK 1
the lateral displacement of the centre of gravity is or main and tail gears, when normal operating
maintained within these limits. techniques are used.
(c) Landing gear dimension data. Figure 1 of
Appendix A contains the basic landing gear
CS 25.479 Level landing conditions
dimension data.
(a) In the level attitude, the aeroplane is
assumed to contact the ground at forward velocity
CS 25.473 Landing load conditions components, ranging from VL1 to 1·25 VL2 parallel to
and assumptions the ground under the conditions prescribed in CS
25.473 with:
(a) For the landing conditions specified in
CS 25.479 to 25.485, the aeroplane is assumed to (1) VL1 equal to VS0(TAS) at the
contact the ground: appropriate landing weight and in standard sea-
level conditions; and
(1) In the attitudes defined in CS 25.479
and CS 25.481. (2) VL2, equal to VS0(TAS) at the
appropriate landing weight and altitudes in a
(2) With a limit descent velocity of 3·05
hot day temperature of 22.8ºC (41ºF) above
m/sec (10 fps) at the design landing weight (the
standard.
maximum weight for landing conditions at
maximum descent velocity); and (3) The effects of increased contact speed
must be investigated if approval of downwind
(3) With a limit descent velocity of 1·83
landings exceeding 19 km/h (10 knots) is requested.
m/sec (6 fps) at the design take-off weight (the
maximum weight for landing conditions at a (b) For the level landing attitude for aeroplanes
reduced descent velocity). with tail wheels, the conditions specified in this
paragraph must be investigated with the aeroplane
(4) The prescribed descent velocities may
horizontal reference line horizontal in accordance
be modified if it is shown that the aeroplane has
with Figure 2 of Appendix A of CS –25.
design features that make it impossible to develop
these velocities. (c) For the level landing attitude for aeroplanes
with nose wheels, shown in Figure 2 of Appendix A
(b) Aeroplane lift, not exceeding aeroplane
of CS –25, the conditions specified in this paragraph
weight, may be assumed, unless the presence of
must be investigated assuming the following
systems or procedures significantly affects the lift.
attitudes:
(c) The method of analysis of aeroplane and
(1) An attitude in which the main wheels
landing gear loads must take into account at least the
are assumed to contact the ground with the nose
following elements:
wheel just clear of the ground; and
(1) Landing gear dynamic characteristics.
(2) If reasonably attainable at the
(2) Spin-up and spring back. specified descent and forward velocities an
attitude in which the nose and main wheels are
(3) Rigid body response.
assumed to contact the ground simultaneously.
(4) Structural dynamic response of the
(d) In addition to the loading conditions
airframe, if significant.
prescribed in sub-paragraph (a) of this paragraph, but
(d) The landing gear dynamic characteristics with maximum vertical ground reactions calculated
must be validated by tests as defined in CS from paragraph (a), the following apply:
25.723(a).
(1) The landing gear and directly
(e) The coefficient of friction between the tyres affected structure must be designed for the
and the ground may be established by considering the maximum vertical ground reaction combined with
effects of skidding velocity and tyre pressure. an aft acting drag component of not less than 25%
However, this coefficient of friction need not be of this maximum vertical ground reaction.
more than 0·8.
(2) The most severe combination of loads
that are likely to arise during a lateral drift
landing must be taken into account. In absence of
CS 25.477 Landing gear arrangement
a more rational analysis of this condition, the
CS 25.479 to 25.485 apply to aeroplanes with following must be investigated:
conventional arrangements of main and nose gears,
1-C-14
(i) A vertical load equal to 75% of CS 25.483 One-gear landing
the maximum ground reaction of CS conditions
25.473(a)(2) must be considered in
For the one-gear landing conditions, the aeroplane is
combination with a drag and side load of
assumed to be in the level attitude and to contact the
40% and 25%, respectively, of that vertical
ground on one main landing gear, in accordance with
load.
Figure 4 of Appendix A of CS –25. In this attitude –
(ii) The shock absorber and tyre
(a) The ground reactions must be the same as
deflections must be assumed to be 75% of
those obtained on that side under CS 25.479(d)(1),
the deflection corresponding to the
and
maximum ground reaction of CS
25.473(a)(2). This load case need not be (b) Each unbalanced external load must be
considered in combination with flat tyres. reacted by aeroplane inertia in a rational or
conservative manner.
(3) The combination of vertical and drag
components is considered to be acting at the
wheel axle centreline.
CS 25.485 Side load conditions
In addition to CS 25.479(d)(2) the following
CS 25.481 Tail-down landing conditions must be considered:
conditions
(a) For the side load condition, the aeroplane is
(a) In the tail-down attitude, the aeroplane is assumed to be in the level attitude with only the main
assumed to contact the ground at forward velocity wheels contacting the ground, in accordance with
components, ranging from VL1 to VL2, parallel to the Figure 5 of Appendix A.
ground under the conditions prescribed in CS 25.473
(b) Side loads of 0·8 of the vertical reaction (on
with:
one side) acting inward and 0·6 of the vertical
(1) VL1 equal to VS0 (TAS) at the reaction (on the other side) acting outward must be
appropriate landing weight and in standard sea- combined with one-half of the maximum vertical
level conditions; and ground reactions obtained in the level landing
conditions. These loads are assumed to be applied at
(2) VL2 equal to VS0 (TAS) at the
the ground contact point and to be resisted by the
appropriate landing weight and altitudes in a hot-
inertia of the aeroplane. The drag loads may be
day temperature of 22.8°C (41ºF) above standard.
assumed to be zero.
The combination of vertical and drag components
is considered to be acting at the main wheel axle
centreline. CS 25.487 Rebound landing condition
(a) The landing gear and its supporting
(b) For the tail-down landing condition for
structure must be investigated for the loads occurring
aeroplanes with tail wheels, the main and tail wheels
during rebound of the aeroplane from the landing
are assumed to contact the ground simultaneously, in
surface.
accordance with Figure 3 of Appendix A. Ground
reaction conditions on the tail wheel are assumed to (b) With the landing gear fully extended and
act – not in contact with the ground, a load factor of 20·0
must act on the unsprung weights of the landing gear.
(1) Vertically; and
This load factor must act in the direction of motion
(2) Up and aft through the axle at 45º to of the unsprung weights as they reach their limiting
the ground line. positions in extending with relation to the sprung
parts of the landing gear.
(c) For the tail-down landing condition for
aeroplanes with nose wheels, the aeroplane is
assumed to be at an attitude corresponding to either
CS 25.489 Ground handling
the stalling angle or the maximum angle allowing
conditions
clearance with the ground by each part of the
aeroplane other than the main wheels, in accordance Unless otherwise prescribed, the landing gear and
with Figure 3 of Appendix A, whichever is less. aeroplane structure must be investigated for the
conditions in CS 25.491 to 25.509 with the
aeroplane at the design ramp weight (the maximum
weight for ground handling conditions). No wing lift
1-C-15
CS -25 BOOK 1
may be considered. The shock absorbers and tyres nose gear vertical reaction caused by sudden
may be assumed to be in their static position. application of maximum braking force as described
in sub-paragraphs (b) and (c) of this paragraph.
(e) In the absence of a more rational analysis,
CS 25.491 Taxi, takeoff and landing
the nose gear vertical reaction prescribed in sub-
roll
paragraph (d) of this paragraph must be calculated in
Within the range of appropriate ground speeds and accordance with the following formula:
approved weights, the aeroplane structure and WT fµAE
landing gear are assumed to be subjected to loads not VN = B +
A+B A + B+ µ E
less than those obtained when the aircraft is
operating over the roughest ground that may
Where:
reasonably be expected in normal operation. (See
AMC 25.491.) VN = Nose gear vertical reaction
WT = Design take-off weight
A = Horizontal distance between the c.g. of the
CS 25.493 Braked roll conditions aeroplane and the nose wheel.
(a) An aeroplane with a tail wheel is assumed to B = Horizontal distance between the c.g. of the
be in the level attitude with the load on the main aeroplane and the line joining the centres of
wheels, in accordance with Figure 6 of Appendix A. the main wheels.
The limit vertical load factor is 1·2 at the design E = Vertical height of the c.g. of the aeroplane
landing weight, and 1·0 at the design ramp weight. A above the ground in the 1·0 g static
drag reaction equal to the vertical reaction multiplied condition.
by a coefficient of friction of 0·8, must be combined µ = Coefficient of friction of 0·8.
with the vertical ground reaction and applied at the f = Dynamic response factor; 2·0 is to be used
ground contact point. unless a lower factor is substantiated.
(b) For an aeroplane with a nose wheel, the In the absence of other information, the dynamic
limit vertical load factor is 1·2 at the design landing response factor f may be defined by the equation.
weight, and 1·0 at the design ramp weight. A drag -πξ
reaction equal to the vertical reaction, multiplied by a f = 1 + exp
1 - ξ2
coefficient of friction of 0·8, must be combined with
the vertical reaction and applied at the ground
contact point of each wheel with brakes. The Where: ξ is the critical damping ratio of the rigid
following two attitudes, in accordance with Figure 6 body pitching mode about the main landing gear
of Appendix A, must be considered: effective ground contact point.
(d) An aeroplane equipped with a nose gear (a) A vertical ground reaction equal to the static
must be designed to withstand the loads arising from load on the tail wheel, in combination with a side
the dynamic pitching motion of the aeroplane due to component of equal magnitude, is assumed.
sudden application of maximum braking force. The (b) If there is a swivel, the tail wheel is
aeroplane is considered to be at design takeoff assumed to be swivelled 90º to the aeroplane
weight with the nose and main gears in contact with longitudinal axis with the resultant load passing
the ground, and with a steady state vertical load through the axle.
factor of 1·0. The steady state nose gear reaction
must be combined with the maximum incremental
1-C-16
(c) If there is a lock, steering device, or shimmy designing the nose gear, its attaching structure and
damper the tail wheel is also assumed to be in the the forward fuselage structure.
trailing position with the side load acting at the
ground contact point.
CS 25.503 Pivoting
(a) The aeroplane is assumed to pivot about one
CS 25.499 Nose-wheel yaw and
side of the main gear with the brakes on that side
steering
locked. The limit vertical load factor must be 1·0
(a) A vertical load factor of 1·0 at the aeroplane and the coefficient of friction 0·8.
centre of gravity, and a side component at the nose
(b) The aeroplane is assumed to be in static
wheel ground contact equal to 0·8 of the vertical
equilibrium, with the loads being applied at the
ground reaction at that point are assumed.
ground contact points, in accordance with Figure 8 of
(b) With the aeroplane assumed to be in static Appendix A.
equilibrium with the loads resulting from the use of
brakes on one side of the main landing gear, the nose
gear, its attaching structure, and the fuselage CS 25.507 Reversed braking
structure forward of the centre of gravity must be
(a) The aeroplane must be in a three point static
designed for the following loads:
ground attitude. Horizontal reactions parallel to the
(1) A vertical load factor at the centre of ground and directed forward must be applied at the
gravity of 1·0. ground contact point of each wheel with brakes. The
limit loads must be equal to 0·55 times the vertical
(2) A forward acting load at the aeroplane
load at each wheel or to the load developed by 1·2
centre of gravity of 0·8 times the vertical load on
times the nominal maximum static brake torque,
one main gear.
whichever is less.
(3) Side and vertical loads at the ground
(b) For aeroplanes with nose wheels, the
contact point on the nose gear that are required for
pitching moment must be balanced by rotational
static equilibrium.
inertia.
(4) A side load factor at the aeroplane
(c) For aeroplanes with tail wheels, the
centre of gravity of zero.
resultant of the ground reactions must pass through
(c) If the loads prescribed in sub-paragraph (b) the centre of gravity of the aeroplane.
of this paragraph result in a nose gear side load
higher than 0·8 times the vertical nose gear load, the
design nose gear side load may be limited to 0·8 CS 25.509 Towing Loads
times the vertical load, with unbalanced yawing
(a) The towing loads specified in sub-paragraph
moments assumed to be resisted by aeroplane inertia
(d) of this paragraph must be considered separately.
forces.
These loads must be applied at the towing fittings
(d) For other than the nose gear, its attaching and must act parallel to the ground. In addition –
structure, and the forward fuselage structure the
(1) A vertical load factor equal to 1·0
loading conditions are those prescribed in sub-
must be considered acting at the centre of gravity;
paragraph (b) of this paragraph, except that –
(2) The shock struts and tyres must be in
(1) A lower drag reaction may be used if
their static positions; and
an effective drag force of 0·8 times the vertical
reaction cannot be reached under any likely (3) With W T as the design ramp weight,
loading condition; and the towing load, FTOW is –
(2) The forward acting load at the centre (i) 0.3 W T for WT less than
of gravity need not exceed the maximum drag 30 000 pounds;
reaction on one main gear, determined in
accordance with CS 25.493 (b). 6WT + 450 000
(ii) for WT
(e) With the aeroplane at design ramp weight,
70
and the nose gear in any steerable position, the between 30 000 and 100 000 pounds; and
combined application of full normal steering torque (iii) 0·15 W T for W T over 100 000
and vertical force equal to 1·33 times the maximum pounds.
static reaction on the nose gear must be considered in
1-C-17
CS -25 BOOK 1
(b) For towing points not on the landing gear (2) The towing loads at the auxiliary gear
but near the plane of symmetry of the aeroplane, the and the drag components of the towing loads at
drag and side tow load components specified for the the main gear must be reacted as follows:
auxiliary gear apply. For towing points located
(i) A reaction with a maximum
outboard of the main gear, the drag and side tow load
value equal to the vertical reaction must be
components specified for the main gear apply.
applied at the axle of the wheel to which the
Where the specified angle of swivel cannot be
load is applied. Enough aeroplane inertia to
reached, the maximum obtainable angle must be
achieve equilibrium must be applied.
used.
(ii) The loads must be reacted by
(c) The towing loads specified in sub-paragraph aeroplane inertia.
(d) of this paragraph must be reacted as follows:
(d) The prescribed towing loads are as specified
(1) The side component of the towing in the following Table:
load at the main gear must be reacted by a side
force at the static ground line of the wheel to
which the load is applied.
Load
Tow Point Position
Magnitude No. Direction
Main gear 0·75 FTOW per 1 Forward, parallel to drag axis
main gear unit 2 Forward, at 30º to drag axis
3 Aft, parallel to drag axis
4 Aft, at 30º to drag axis
Swivelled forward 5 Forward
1·0 FTOW
6 Aft
Swivelled aft 7 Forward
8 Aft
Auxiliary gear Swivelled 45º from 9 Forward, in plane of wheel
0·5 FTOW
forward 10 Aft, in plane of wheel
Swivelled 45ºfrom 11 Forward, in plane of wheel
aft 12 Aft, in plane of wheel
CS 25.511 Ground load: for each landing, taxying, and ground handling
unsymmetrical loads on condition, taking into account the effects of the
multiple-wheel units following factors:
(a) General. Multiple-wheel landing gear (1) The number of wheels and their
units are assumed to be subjected to the limit ground physical arrangements. For truck type landing
loads prescribed in this Subpart under sub-paragraphs gear units, the effects of any see-saw motion of
(b) through (f) of this paragraph. In addition – the truck during the landing impact must be
considered in determining the maximum design
(1) A tandem strut gear arrangement is a
loads for the fore and aft wheel pairs.
multiple-wheel unit; and
(2) Any differentials in tyre diameters
(2) In determining the total load on a gear
resulting from a combination of manufacturing
unit with respect to the provisions of sub-
tolerances, tyre growth, and tyre wear. A
paragraphs (b) through (f) of this paragraph, the
maximum tyre-diameter differential equal to two-
transverse shift in the load centroid, due to
thirds of the most unfavourable combination of
unsymmetrical load distribution on the wheels,
diameter variations that is obtained when taking
may be neglected.
into account manufacturing tolerances, tyre
(b) Distribution of limit loads to wheels; tyres growth and tyre wear, may be assumed.
inflated. The distribution of the limit loads among
the wheels of the landing gear must be established
1-C-18
(3) Any unequal tyre inflation pressure, (3) The vertical load factor at the centre
assuming the maximum variation to be ±5% of the of gravity must be 60% and 50% respectively, of
nominal tyre inflation pressure. the factor with no deflated tyres, except that it
may not be less than 1 g; and
(4) A runway crown of zero and a runway
crown having a convex upward shape that may be (4) Pivoting need not be considered.
approximated by a slope of 1·5% with the
(f) Towing conditions. For one and for two
horizontal. Runway crown effects must be
deflated tyres, the towing load, FTOW, must be 60%
considered with the nose gear unit on either slope
and 50% respectively, of the load prescribed.
of the crown.
(5) The aeroplane attitude.
CS 25.519 Jacking and tie-down
(6) Any structural deflections.
provisions
(c) Deflated tyres. The effect of deflated tyres
(a) General. The aeroplane must be designed to
on the structure must be considered with respect to
withstand the limit load conditions resulting from the
the loading conditions specified in sub-paragraphs
static ground load conditions of sub-paragraph (b) of
(d) through (f) of this paragraph, taking into account
this paragraph and, if applicable, sub-paragraph (c)
the physical arrangement of the gear components. In
of this paragraph at the most critical combinations of
addition –
aeroplane weight and centre of gravity. The
(1) The deflation of any one tyre for each maximum allowable load at each jack pad must be
multiple wheel landing gear unit, and the deflation specified.
of any two critical tyres for each landing gear unit
(b) Jacking. The aeroplane must have
using four or more wheels per unit, must be
provisions for jacking and must withstand the
considered; and
following limit loads when the aeroplane is supported
(2) The ground reactions must be applied on jacks:
to the wheels with inflated tyres except that, for
(1) For jacking by the landing gear at the
multiple-wheel gear units with more than one
maximum ramp weight of the aeroplane, the
shock strut, a rational distribution of the ground
aeroplane structure must be designed for a vertical
reactions between the deflated and inflated tyres,
load of 1·33 times the vertical static reaction at
accounting for the differences in shock strut
each jacking point acting singly and in
extensions resulting from a deflated tyre, may be
combination with a horizontal load of 0·33 times
used.
the vertical static reaction applied in any
(d) Landing conditions. For one and for two direction.
deflated tyres, the applied load to each gear unit is
(2) For jacking by other aeroplane
assumed to be 60% and 50%, respectively, of the
structure at maximum approved jacking weight:
limit load applied to each gear for each of the
prescribed landing conditions. However, for the drift (i) The aeroplane structure must be
landing condition of CS 25.485, 100% of the vertical designed for a vertical load of 1·33 times the
load must be applied. vertical reaction at each jacking point acting
singly and in combination with a horizontal
(e) Taxying and ground handling conditions.
load of 0·33 times the vertical static reaction
For one and for two deflated tyres –
applied in any direction.
(1) The applied side or drag load factor,
(ii) The jacking pads and local
or both factors, at the centre of gravity must be
structure must be designed for a vertical
the most critical value up to 50% and 40%,
load of 2·0 times the vertical static reaction
respectively, of the limit side or drag load factors,
at each jacking point, acting singly and in
or both factors, corresponding to the most severe
combination with a horizontal load of 0·33
condition resulting from consideration of the
times the vertical static reaction applied in
prescribed taxying and ground handling
any direction.
conditions.
(c) Tie-down. If tie-down points are provided,
(2) For the braked roll conditions of CS
the main tie-down points and local structure must
25.493 (a) and (b) (2), the drag loads on each
withstand the limit loads resulting from a 120 km/h
inflated tyre may not be less than those at each
(65-knot) horizontal wind from any direction.
tyre for the symmetrical load distribution with no
deflated tyres;
1-C-19
CS -25 BOOK 1
1-C-20
(1) Where upper torso straps are used Fatigue Evaluation
tension loads in individual straps must not exceed
794 kg.(1750lb) If dual straps are used for
restraining the upper torso, the total strap tension
CS 25.571 Damage-tolerance and
loads must not exceed 907kg (2000 lb)).
fatigue evaluation of
(2) The maximum compressive load structure
measured between the pelvis and the lumbar (a) General. An evaluation of the strength,
column of the anthropomorphic dummy must not detail design, and fabrication must show that
exceed 680 kg. (1500lb) catastrophic failure due to fatigue, corrosion, or
accidental damage, will be avoided throughout the
(3) The upper torso restraint straps
operational life of the aeroplane. This evaluation
(where installed) must remain on the occupant’s
must be conducted in accordance with the provisions
shoulder during the impact.
of sub-paragraphs (b) and (e) of this paragraph,
(4) The lap safety belt must remain on the except as specified in sub-paragraph (c) of this
occupant’s pelvis during the impact. paragraph, for each part of the structure which could
contribute to a catastrophic failure (such as wing,
(5) Each occupant must be protected from
empennage, control surfaces and their systems, the
serious head injury under the conditions
fuselage, engine mounting, landing gear, and their
prescribed in sub-paragraph (b) of this paragraph.
related primary attachments). (See AMC 25.571 (a),
Where head contact with seats or other structure
(b) and (e).) For turbine engine powered aeroplanes,
can occur, protection must be provided so that the
those parts which could contribute to a catastrophic
head impact does not exceed a Head Injury
failure must also be evaluated under sub-paragraph
Criterion (HIC) of 1000 units. The level of HIC is
(d) of this paragraph. In addition, the following
defined by the equation –
apply:
t2
2⋅5
∫
1 (1) Each evaluation required by this
HIC = (t 2 − t 1 ) a(t)dt
(t 2 − t 1 ) t1 paragraph must include –
max
(i) The typical loading spectra,
Where – temperatures, and humidities expected in
t1 is the initial integration time, service;
(7) The seat must remain attached at all (2) The service history of aeroplanes of
points of attachment, although the structure may similar structural design, taking due account of
have yielded. differences in operating conditions and
procedures, may be used in the evaluations
(8) Seats must not yield under the tests required by this paragraph.
specified in sub-paragraphs (b)(1) and (b)(2) of
this paragraph to the extent they would impede (3) Based on the evaluations required by
rapid evacuation of the aeroplane occupants. this paragraph, inspections or other procedures
must be established as necessary to prevent
catastrophic failure, and must be included in the
CS 25.563 Structural ditching Airworthiness Limitations Section of the
provisions Instructions for Continued Airworthiness required
by CS 25.1529.
Structural strength considerations of ditching
provisions must be in accordance with CS 25.801 (b) Damage-tolerance (fail-safe) evaluation.
(e). The evaluation must include a determination of the
probable locations and modes of damage due to
fatigue, corrosion, or accidental damage. The
1-C-21
CS -25 BOOK 1
determination must be by analysis supported by test period, smaller loads than those of sub-paragraphs
evidence and (if available) service experience. (b)(1) to (b)(6) inclusive may be used by agreement
Damage at multiple sites due to prior fatigue with the Authority. A probability approach may be
exposure must be included where the design is such used in these latter assessments, substantiating that
that this type of damage can be expected to occur. catastrophic failure is extremely improbable. (See
The evaluation must incorporate repeated load and AMC 25.571 (a), (b) and (e) paragraph 2.1.2.)
static analyses supported by test evidence. The
(c) Fatigue (safe-life) evaluation. Compliance
extent of damage for residual strength evaluation at
with the damage-tolerance requirements of sub-
any time within the operational life must be
paragraph (b) of this paragraph is not required if the
consistent with the initial detectability and
applicant establishes that their application for
subsequent growth under repeated loads. The
particular structure is impractical. This structure
residual strength evaluation must show that the
must be shown by analysis, supported by test
remaining structure is able to withstand loads
evidence, to be able to withstand the repeated loads
(considered as static ultimate loads) corresponding to
of variable magnitude expected during its service life
the following conditions:
without detectable cracks. Appropriate safe-life
(1) The limit symmetrical manoeuvring scatter factors must be applied.
conditions specified in CS 25.337 up to VC and in
(d) Sonic fatigue strength. It must be shown by
CS 25.345.
analysis, supported by test evidence, or by the
(2) The limit gust conditions specified service history of aeroplanes of similar structural
in CS 25.341 at the specified speeds up to VC and design and sonic excitation environment, that –
in CS 25.345.
(1) Sonic fatigue cracks are not probable
(3) The limit rolling conditions specified in any part of the flight structure subject to sonic
in CS 25.349 and the limit unsymmetrical excitation; or
conditions specified in CS 25.367 and CS
(2) Catastrophic failure caused by sonic
25.427(a) through (c), at speeds up to VC.
cracks is not probable assuming that the loads
(4) The limit yaw manoeuvring prescribed in sub-paragraph (b) of this paragraph
conditions specified in CS 25.351 at the specified are applied to all areas affected by those cracks.
speeds up to VC.
(e) Damage-tolerance (discrete source)
(5) For pressurised cabins, the following evaluation. The aeroplane must be capable of
conditions: successfully completing a flight during which likely
structural damage occurs as a result of –
(i) The normal operating
differential pressure combined with the (1) Bird impact as specified in CS
expected external aerodynamic pressures 25.631;
applied simultaneously with the flight
(2) Reserved
loading conditions specified in sub-
paragraphs (b)(1) to (b)(4) of this paragraph (3) Reserved
if they have a significant effect.
(4) Sudden decompression of
(ii) The maximum value of normal compartments as specified in CS 25.365 (e) and
operating differential pressure (including (f).
the expected external aerodynamic pressures
The damaged structure must be able to withstand
during 1 g level flight) multiplied by a
the static loads (considered as ultimate loads) which
factor of 1·15 omitting other loads.
are reasonably expected to occur at the time of the
(6) For landing gear and directly-affected occurrence and during the completion of the flight.
airframe structure, the limit ground loading Dynamic effects on these static loads need not be
conditions specified in CS 25.473, CS 25.491 considered. Corrective action to be taken by the pilot
and CS 25.493. following the incident, such as limiting manoeuvres,
avoiding turbulence, and reducing speed, may be
If significant changes in structural stiffness or
considered. If significant changes in structural
geometry, or both, follow from a structural failure, or
stiffness or geometry, or both, follow from a
partial failure, the effect on damage tolerance must
structural failure or partial failure, the effect on
be further investigated. (See AMC 25.571 (b) and
damage tolerance must be further investigated. (See
(e).) The residual strength requirements of this sub-
AMC 25.571(a), (b) and (e), paragraph 2.7.2 and
paragraph (b) apply, where the critical damage is not
AMC 25.571 (b) and (e).)
readily detectable. On the other hand, in the case of
damage which is readily detectable within a short
1-C-22
Lightning Protection
1-C-23
CS -25 BOOK 1
1-C-24
BOOK 1 CS-25
1-D-1
CS-25 BOOK 1
1-D-2
BOOK 1 CS-25
and modifications to the type design have a VFC if it is shown, by correlation of the flight
significant effect on the critical flutter modes. test data with other test data or analyses, that
hazardous flutter or divergence will not occur at
(b) Flutter and divergence prevention. The
any speed up to VD.
dynamic evaluation of the aeroplane must include
an investigation of the significant elastic, inertia, (3) The structural failures described in
and aerodynamic forces associated with the sub-paragraphs (d)(4)(i) and (ii) of this
rotations and displacements of the plane of the paragraph need not be considered in showing
propeller. In addition, the following apply: compliance with this paragraph if engineering
data substantiate that the probability of their
(1) The aeroplane must be designed to
occurrence is negligible by showing that the
be free from flutter and divergence (unstable
structural element is designed with –
structural distortion due to aerodynamic loading)
for all combinations of altitude and speed (i) Conservative static strength
encompassed by the VD/MD versus altitude margins for each ground and flight loading
envelope enlarged at all points by an increase of conditions specified in this CS–25; or
20% in equivalent air-speed at both constant
(ii) Sufficient fatigue strength for
Mach number and constant altitude, except that
the loading spectrum expected in
the envelope may be limited to a maximum
operation.
Mach number of 1·0 when MD is less than 1·0 at
all design altitudes and the following is (4) The failures, malfunctions, or
established: adverse conditions used to show compliance
with this paragraph are as follows:
(i) A proper margin of damping
exists at all speeds up to MD; and (i) Failure of any single element
of the structure supporting any engine,
(ii) There is no large and rapid
independently mounted propeller shaft,
reduction in damping as MD is approached.
large auxiliary power unit, or large
(2) If concentrated balance weights are externally mounted aerodynamic body
used on control surfaces, their effectiveness and (such as an external fuel tank).
strength, including supporting structure, must be
(ii) Any single failure of the
substantiated.
engine structure, on turbo-propeller
(c) Loss of control due to structural aeroplanes, that would reduce the yaw or
deformation. The aeroplane must be designed to be pitch rigidity of the propeller rotational
free from control reversal and from undue loss of axis.
longitudinal, lateral, and directional stability and
(iii) Absence of propeller
control, as a result of structural deformation
aerodynamic forces resulting from the
(including that of the control surface covering) at
feathering of any single propeller, and, for
speeds up to the speed prescribed in sub-paragraph
aeroplanes with four or more engines, the
(b) of this paragraph for flutter prevention.
feathering of the critical combination of
(d) Fail-safe criteria. The following fail-safe two propellers. In addition, any single
criteria must be met: feathered propeller must be paired with the
failures, specified in (d)(4)(i) of this sub-
(1) It must be shown, by analysis or
paragraph, involving failure of any single
tests, that the aeroplane is free from such flutter
element of the structure supporting any
or divergence that would preclude safe flight, at
engine or independently mounted propeller
any speed up to VD, after each of the following:
shaft, and the failures specified in
(i) Each of the failures, (d)(4)(ii) of this sub-paragraph.
malfunctions, or adverse conditions listed
(iv) Any single propeller rotating
in sub-paragraph (d)(4) of this paragraph.
at the highest likely overspeed.
(ii) Any other combination of
(v) Failure of each principal
failures, malfunctions, or adverse
structural element selected for compliance
conditions not shown to be extremely
with CS 25.571 (b). Safety following a
improbable.
failure may be substantiated by showing
(2) If a failure, malfunction, or adverse that losses in rigidity or changes in
condition described in sub-paragraph (d)(4) of frequency, mode shape, or damping are
this paragraph is simulated during a flight test in within the parameter variations shown to
showing compliance with this paragraph, the be satisfactory in the flutter and
maximum speed investigated need not exceed divergence investigations.
1-D-3
CS-25 BOOK 1
(vi) Any single failure or mal- rational investigation, a factor of safety of not less
function, or combinations thereof, in the than 6·67 must be used with respect to the ultimate
flight control system considered under CS bearing strength of the softest material used as a
25.671, 25.672 and 25.1309, and any bearing.
single failure in any flutter damper system.
(b) Hinges must have enough strength and
Investigation of forced structural vibration
rigidity for loads parallel to the hinge line.
other than flutter, resulting from failures,
malfunctions, or adverse conditions in the
automatic flight control system may be
CONTROL SYSTEMS
limited to airspeed up to VC.
CS 25.671 General
CS 25.631 Bird strike damage (a) Each control and control system must
operate with the ease, smoothness, and positiveness
The aeroplane must be designed to assure capability
appropriate to its function. (See AMC 25.671 (a).)
of continued safe flight and landing of the
aeroplane after impact with a 4 lb bird when the (b) Each element of each flight control system
velocity of the aeroplane (relative to the bird along must be designed, or distinctively and permanently
the aeroplane’s flight path) is equal to VC at sea- marked, to minimise the probability of incorrect
level or 0·85 VC at 2438 m (8000 ft), whichever is assembly that could result in the malfunctioning of
the more critical. Compliance may be shown by the system. (See AMC 25.671 (b).)
analysis only when based on tests carried out on
(c) The aeroplane must be shown by analysis,
sufficiently representative structures of similar
test, or both, to be capable of continued safe flight
design. (See AMC 25.631.)
and landing after any of the following failures or
jamming in the flight control system and surfaces
(including trim, lift, drag, and feel systems) within
CONTROL SURFACES the normal flight envelope, without requiring
exceptional piloting skill or strength. Probable
CS 25.651 Proof of strength malfunctions must have only minor effects on
control system operation and must be capable of
(a) Limit load tests of control surfaces are
being readily counteracted by the pilot.
required. These tests must include the horn or
fitting to which the control system is attached. (1) Any single failure not shown to be
extremely improbable, excluding jamming, (for
(b) Compliance with the special factors
example, disconnection or failure of mechanical
requirements of CS 25.619 to 25.625 and 25.657 for
elements, or structural failure of hydraulic
control surface hinges must be shown by analysis or
components, such as actuators, control spool
individual load tests.
housing, and valves). (See AMC 25.671(c)(1).)
(2) Any combination of failures not
CS 25.655 Installation shown to be extremely improbable, excluding
jamming (for example, dual electrical or
(a) Movable tail surfaces must be installed so
hydraulic system failures, or any single failure in
that there is no interference between any surfaces
combination with any probable hydraulic or
when one is held in its extreme position and the
electrical failure).
others are operated through their full angular
movement. (3) Any jam in a control position
normally encountered during take-off, climb,
(b) If an adjustable stabiliser is used, it must
cruise, normal turns, descent and landing unless
have stops that will limit its range of travel to the
the jam is shown to be extremely improbable, or
maximum for which the aeroplane is shown to meet
can be alleviated. A runaway of a flight control
the trim requirements of CS 25.161.
to an adverse position and jam must be
accounted for if such runaway and subsequent
jamming is not extremely improbable.
CS 25.657 Hinges
(d) The aeroplane must be designed so that it
(a) For control surface hinges, including ball,
is controllable if all engines fail. Compliance with
roller, and self-lubricated bearing hinges, the
this requirement may be shown by analysis where
approved rating of the bearing may not be
that method has been shown to be reliable.
exceeded. For non-standard bearing hinge
configurations, the rating must be established on the
basis of experience or tests and, in the absence of a
1-D-4
BOOK 1 CS-25
CS 25.672 Stability augmentation and (c) Each stop must be able to withstand any
automatic and power- loads corresponding to the design conditions for the
operated systems control system.
If the functioning of stability augmentation or other
automatic or power-operated systems is necessary
CS 25.677 Trim systems
to show compliance with the flight characteristics
requirements of this CS-25, such systems must (a) Trim controls must be designed to prevent
comply with CS 25.671 and the following: inadvertent or abrupt operation and to operate in the
plane, and the sense of motion, of the aeroplane.
(a) A warning, which is clearly
distinguishable to the pilot under expected flight (b) There must be means adjacent to the trim
conditions without requiring his attention, must be control to indicate the direction of the control
provided for any failure in the stability movement relative to the aeroplane motion. In
augmentation system or in any other automatic or addition, there must be clearly visible means to
power-operated system, which could result in an indicate the position of the trim device with respect
unsafe condition if the pilot were not aware of the to the range of adjustment. The indicator must be
failure. Warning systems must not activate the clearly marked with the range within which it has
control systems. been demonstrated that take-off is safe for all centre
of gravity positions approved for take-off.
(b) The design of the stability augmentation
system or of any other automatic or power-operated (c) Trim control systems must be designed to
system must permit initial counteraction of failures prevent creeping in flight. Trim tab controls must
of the type specified in CS 25.671 (c) without be irreversible unless the tab is appropriately
requiring exceptional pilot skill or strength, by balanced and shown to be free from flutter.
either the deactivation of the system, or a failed
(d) If an irreversible tab control system is
portion thereof, or by overriding the failure by
used, the part from the tab to the attachment of the
movement of the flight controls in the normal sense.
irreversible unit to the aeroplane structure must
(c) It must be shown that after any single consist of a rigid connection.
failure of the stability augmentation system or any
other automatic or power-operated system –
(1) The aeroplane is safely controllable CS 25.679 Control system gust locks
when the failure or malfunction occurs at any
(a) There must be a device to prevent damage
speed or altitude within the approved operating
to the control surfaces (including tabs), and to the
limitations that is critical for the type of failure
control system, from gusts striking the aeroplane
being considered. (See AMC 25.672 (c) (1).)
while it is on the ground. If the device, when
(2) The controllability and engaged, prevents normal operation of the control
manoeuvrability requirements of this CS-25 are surfaces by the pilot, it must –
met within a practical operational flight
(1) Automatically disengage when the
envelope (for example, speed, altitude, normal
pilot operates the primary flight controls in a
acceleration, and aeroplane configurations)
normal manner; or
which is described in the Aeroplane Flight
Manual; and (2) Limit the operation of the aeroplane
so that the pilot receives unmistakable warning
(3) The trim, stability, and stall
at the start of take-off. (See AMC 25.679(a)(2).)
characteristics are not impaired below a level
needed to permit continued safe flight and (b) The device must have means to preclude
landing. the possibility of it becoming inadvertently engaged
in flight. (See AMC 25.679(b).)
CS 25.675 Stops
CS 25.681 Limit load static tests
(a) Each control system must have stops that
positively limit the range of motion of each (a) Compliance with the limit load
movable aerodynamic surface controlled by the requirements of this CS–25 must be shown by tests
system. in which –
(1) The direction of the test loads
(b) Each stop must be located so that wear,
produces the most severe loading in the control
slackness, or take-up adjustments will not adversely
system; and
affect the control characteristics of the aeroplane
because of a change in the range of surface travel.
1-D-5
CS-25 BOOK 1
1-D-6
BOOK 1 CS-25
(b) Each lift and drag device control must be must be designed for the loads imposed when the
designed and located to make inadvertent operation wing-flaps or slats on one side are carrying the
improbable. Lift and drag devices intended for most severe load occurring in the prescribed
ground operation only must have means to prevent symmetrical conditions and those on the other side
the inadvertent operation of their controls in flight are carrying not more than 80% of that load.
if that operation could be hazardous.
(d) The interconnection must be designed for
(c) The rate of motion of the surfaces in the loads resulting when interconnected flap or slat
response to the operation of the control and the surfaces on one side of the plane of symmetry are
characteristics of the automatic positioning or load jammed and immovable while the surfaces on the
limiting device must give satisfactory flight and other side are free to move and the full power of the
performance characteristics under steady or surface actuating system is applied. (See AMC
changing conditions of airspeed, engine power, and 25.701(d).)
aeroplane attitude.
(d) The lift device control must be designed to
CS 25.703 Take-off warning system
retract the surfaces from the fully extended
(See AMC 25.703)
position, during steady flight at maximum
continuous engine power at any speed below VF + A take-off warning system must be installed and
17 km/hr (9·0 knots). must meet the following requirements:
(a) The system must provide to the pilots an
aural warning that is automatically activated during
CS 25.699 Lift and drag device indicator
the initial portion of the take-off roll if the
(a) There must be means to indicate to the aeroplane is in a configuration, including any of the
pilots the position of each lift or drag device having following that would not allow a safe take-off:
a separate control in the cockpit to adjust its
(1) The wing-flaps or leading edge
position. In addition, an indication of
devices are not within the approved range of
unsymmetrical operation or other malfunction in the
take-off positions.
lift or drag device systems must be provided when
such indication is necessary to enable the pilots to (2) Wing spoilers (except lateral control
prevent or counteract an unsafe flight or ground spoilers meeting the requirements of CS 25.671),
condition, considering the effects on flight speed brakes, or longitudinal trim devices are in
characteristics and performance. a position that would not allow a safe take-off.
(b) There must be means to indicate to the (3) The parking brake is unreleased.
pilots the take-off, en-route, approach, and landing
(b) The aural warning required by sub-
lift device positions.
paragraph (a) of this paragraph must continue until
(c) If any extension of the lift and drag device –
beyond the landing position is possible, the control
(1) The take-off configuration is
must be clearly marked to identify this range of
changed to allow a safe take-off;
extension.
(2) Action is taken by the pilot to
terminate the take-off roll;
CS 25.701 Flap and slat interconnection
(3) The aeroplane is rotated for take-off;
(a) Unless the aeroplane has safe flight or
characteristics with the flaps or slats retracted on
(4) The warning is manually silenced by
one side and extended on the other, the motion of
the pilot. The means to silence the warning must
flaps or slats on opposite sides of the plane of
not be readily available to the flight crew such
symmetry must be synchronised by a mechanical
that it could be operated instinctively,
interconnection or approved equivalent means.
inadvertently, or by habitual reflexive action.
(b) If a wing-flap or slat interconnection or Before each take-off, the warning must be
equivalent means is used, it must be designed to rearmed automatically, or manually if the
account for the applicable unsymmetrical loads, absence of automatic rearming is clear and
including those resulting from flight with the unmistakable.
engines on one side of the plane of symmetry (c) The means used to activate the system
inoperative and the remaining engines at take-off must function properly for all authorised take-off
power. power settings and procedures, and throughout the
ranges of take-off weights, altitudes, and
(c) For aeroplanes with flaps or slats that are
temperatures for which certification is requested.
not subjected to slipstream conditions, the structure
1-D-7
CS-25 BOOK 1
1-D-8
BOOK 1 CS-25
(c) Emergency operation. There must be an (f) Protection of equipment on landing gear
emergency means for extending the landing gear in and in wheel wells. Equipment that is essential to
the event of – the safe operation of the aeroplane and that is
located on the landing gear and in wheel wells must
(1) Any reasonably probable failure in
be protected from the damaging effects of –
the normal retraction system; or
(1) A bursting tyre, (see AMC 25.729
(2) The failure of any single source of
(f));
hydraulic, electric, or equivalent energy supply.
(2) A loose tyre tread unless it is shown
(d) Operation test. The proper functioning of
that a loose tyre tread cannot cause damage; and
the retracting mechanism must be shown by
operation tests. (3) Possible wheel brake temperatures
(see AMC 25.729 (f)).
(e) Position indicator and warning device.
(See AMC 25.729 (e).) If a retractable landing gear
is used, there must be a landing gear position
CS 25.731 Wheels
indicator easily visible to the pilot or to the
appropriate crew members (as well as necessary (a) Each main and nose wheel must be
devices to actuate the indicator) to indicate without approved.
ambiguity that the retractable units and their
(b) The maximum static load rating of each
associated doors are secured in the extended (or
wheel may not be less than the corresponding static
retracted) position. The means must be designed as
ground reaction with –
follows:
(1) Design maximum weight; and
(1) If switches are used, they must be
located and coupled to the landing gear (2) Critical centre of gravity.
mechanical systems in a manner that prevents an
(c) The maximum limit load rating of each
erroneous indication of ‘down and locked’ if the
wheel must equal or exceed the maximum radial
landing gear is not in a fully extended position,
limit load determined under the applicable ground
or of ‘up and locked’ if the landing gear is not in
load requirements of this CS–25.
the fully retracted position. The switches may
be located where they are operated by the actual (d) Overpressure burst prevention. Means must
landing gear locking latch or device. be provided in each wheel to prevent wheel failure
and tyre burst that may result from excessive
(2) The flight crew must be given an
pressurisation of the wheel and tyre assembly.
aural warning that functions continuously, or is
periodically repeated, if a landing is attempted
(e) Braked wheels. Each braked wheel must
when the landing gear is not locked down.
meet the applicable requirements of CS 25.735.
(3) The warning must be given in
sufficient time to allow the landing gear to be
locked down or a go-around to be made.
CS 25.733 Tyres
(4) There must not be a manual shut-off
(a) When a landing gear axle is fitted with a
means readily available to the flight crew for the
single wheel and tyre assembly, the wheel must be
warning required by sub-paragraph (e)(2) of this
fitted with a suitable tyre of proper fit with a speed
paragraph such that it could be operated
rating approved by the Agency that is not exceeded
instinctively, inadvertently or by habitual
under critical conditions, and with a load rating
reflexive action.
approved by the Agency that is not exceeded under
(5) The system used to generate the –
aural warning must be designed to minimise
(1) The loads on the main wheel tyre,
false or inappropriate alerts.
corresponding to the most critical combination
(6) Failures of systems used to inhibit of aeroplane weight (up to the maximum weight)
the landing gear aural warning, that would and centre of gravity position; and
prevent the warning system from operating, must
(2) The loads corresponding to the
be improbable.
ground reactions in sub-paragraph (b) of this
(7) A clear indication or warning must paragraph, on the nose-wheel tyre, except as
be provided whenever the landing gear position provided in sub-paragraphs (b)(2) and (b)(3) of
is not consistent with the landing gear selector this paragraph.
lever position.
(b) The applicable ground reactions for nose-
wheel tyres are as follows:
1-D-9
CS-25 BOOK 1
(1) The static ground reaction for the (75 000 pounds), tyres mounted on braked wheels
tyre corresponding to the most critical must be inflated with dry nitrogen or other gases
combination of aeroplane weight (up to shown to be inert so that the gas mixture in the tyre
maximum ramp weight) and centre of gravity does not contain oxygen in excess of 5% by
position with a force of 1·0 g acting downward volume, unless it can be shown that the tyre liner
at the centre of gravity. This load may not material will not produce a volatile gas when
exceed the load rating of the tyre. heated, or that means are provided to prevent tyre
temperatures from reaching unsafe levels.
(2) The ground reaction of the tyre
corresponding to the most critical combination
of aeroplane weight (up to maximum landing
CS 25.735 Brakes and braking systems
weight) and centre of gravity position combined
(See AMC 25.735)
with forces of 1·0 g downward and 0·31 g
forward acting at the centre of gravity. The
(a) Approval. Each assembly consisting of a
reactions in this case must be distributed to the
wheel(s) and brake(s) must be approved.
nose and main wheels by the principles of
static’s with a drag reaction equal to 0·31 times
(b) Brake system capability. The brake system,
the vertical load at each wheel with brakes
associated systems and components must be
capable of producing this ground reaction. This
designed and constructed so that:
nose tyre load may not exceed 1·5 times the load
rating of the tyre.
(1) If any electrical, pneumatic,
(3) The ground reaction of the tyre hydraulic, or mechanical connecting or
corresponding to the most critical combination transmitting element fails, or if any single
of aeroplane weight (up to maximum ramp source of hydraulic or other brake operating
weight) and centre of gravity position combined energy supply is lost, it is possible to bring the
with forces of 1·0 g downward and 0·20 g aeroplane to rest with a braked roll stopping
forward acting at the centre of gravity. The distance of not more than two times that
reactions in this case must be distributed to the obtained in determining the landing distance as
nose and main wheels by the principles of prescribed in CS 25.125.
static’s with a drag reaction equal to 0·20 times
the vertical load at each wheel with brakes (2) Fluid lost from a brake hydraulic
capable of producing this ground reaction. This system following a failure in, or in the vicinity
nose tyre load may not exceed 1·5 times the load of, the brakes is insufficient to cause or support
rating of the tyre. a hazardous fire on the ground or in flight.
(c) When a landing gear axle is fitted with
(c) Brake controls. The brake controls must be
more than one wheel and tyre assembly, such as
designed and constructed so that:
dual or dual-tandem, each wheel must be fitted with
a suitable tyre of proper fit with a speed rating
(1) Excessive control force is not
approved by the Agency that is not exceeded under
required for their operation.
critical conditions, and with a load rating approved
by the Agency that is not exceeded by –
(2) If an automatic braking system is
(1) The loads on each main wheel tyre, installed, means are provided to:
corresponding to the most critical combination
of aeroplane weight (up to maximum weight) (i) Arm and disarm the system, and
and centre of gravity position, when multiplied
by a factor of 1·07; and (ii) Allow the pilot(s) to override
the system by use of manual braking.
(2) Loads specified in sub-paragraphs
(a)(2), (b)(1), (b)(2) and (b)(3) of this paragraph
(d) Parking brake. The aeroplane must have a
on each nose-wheel tyre.
parking brake control that, when selected on, will,
(d) Each tyre installed on a retractable landing without further attention, prevent the aeroplane
gear system must, at the maximum size of the tyre from rolling on a dry and level paved runway when
type expected in service, have a clearance to the most adverse combination of maximum thrust
surrounding structure and systems that is adequate on one engine and up to maximum ground idle
to prevent unintended contact between the tyre and thrust on any, or all, other engine(s) is applied. The
any part of the structure or systems. control must be suitably located or be adequately
protected to prevent inadvertent operation. There
(e) For an aeroplane with a maximum
must be indication in the cockpit when the parking
certificated take-off weight of more than 34019 kg
brake is not fully released.
1-D-10
BOOK 1 CS-25
(e) Anti-skid system. If an anti-skid system is (g) Brake condition after high kinetic energy
installed: dynamometer stop(s). Following the high kinetic
energy stop demonstration(s) required by sub-
(1) It must operate satisfactorily over the paragraph (f) of this paragraph, with the parking
range of expected runway conditions, without brake promptly and fully applied for at least 3
external adjustment. minutes, it must be demonstrated that for at least 5
minutes from application of the parking brake, no
(2) It must, at all times, have priority condition occurs (or has occurred during the stop),
over the automatic braking system, if installed. including fire associated with the tyre or wheel and
brake assembly, that could prejudice the safe and
(f) Kinetic energy capacity— complete evacuation of the aeroplane.
(1) Design landing stop. The design- (h) Stored energy systems. An indication to
landing stop is an operational landing stop at the flight crew of the usable stored energy must be
maximum landing weight. The design landing provided if a stored energy system is used to show
stop brake kinetic energy absorption compliance with sub-paragraph (b)(1) of this
requirement of each wheel, brake, and tyre paragraph. The available stored energy must be
assembly must be determined. It must be sufficient for:
substantiated by dynamometer testing that the
wheel, brake and tyre assembly is capable of (1) At least 6 full applications of the
absorbing not less than this level of kinetic brakes when an anti-skid system is not
energy throughout the defined wear range of the operating; and
brake. The energy absorption rate derived from
the aeroplane manufacturer’s braking (2) Bringing the aeroplane to a complete
requirements must be achieved. The mean stop when an anti-skid system is operating,
deceleration must not be less than 3.1 m/s2 (10 under all runway surface conditions for which
fps2). the aeroplane is certificated.
(2) Maximum kinetic energy accelerate- (i) Brake wear indicators. Means must be
stop. The maximum kinetic energy accelerate- provided for each brake assembly to indicate when
stop is a rejected take-off for the most critical the heat sink is worn to the permissible limit. The
combination of aeroplane landing weight and means must be reliable and readily visible.
speed. The accelerate-stop brake kinetic energy
absorption requirement of each wheel, brake, (j) Over-temperature burst prevention. Means
and tyre assembly must be determined. It must must be provided in each braked wheel to prevent a
be substantiated by dynamometer testing that wheel failure, a tyre burst, or both, that may result
the wheel brake and tyre assembly is capable of from elevated brake temperatures. Additionally, all
absorbing not less than this level of kinetic wheels must meet the requirements of CS
energy throughout the defined wear range of the 25.731(d).
brake. The energy absorption rate derived from
the aeroplane's braking requirements must be (k) Compatibility. Compatibility of the wheel
achieved. The mean deceleration must not be and brake assemblies with the aeroplane and its
less than 1.8 m/s2 (6 fps2). systems must be substantiated.
1-D-11
CS-25 BOOK 1
extension or after retraction of the landing gear) (a) For aeroplanes with passenger seating
cannot interfere with the correct retraction or configuration of 20 seats or more, the emergency
extension of the landing gear. exit configuration must be designed so that neither
crewmembers nor passengers require use of the
(c) Under failure conditions the system must
flight deck door in order to reach the emergency
comply with CS 25.1309 (b), (c) and (d). The
exits provided for them; and
arrangement of the system must be such that no
single failure will result in a nose-wheel position, (b) Means must be provided to enable flight-
which will lead to a Hazardous Effect. Where crew members to directly enter the passenger
reliance is placed on nose-wheel steering in compartment from the pilot compartment if the
showing compliance with CS 25.233, the nose- cockpit door becomes jammed.
wheel steering system must be shown to comply
(c) There must be an emergency means to
with CS 25.1309. (See AMC 25.745 (c).)
enable a crewmember to enter the pilot
(d) The design of the attachment for towing compartment in the event that the flight crew
the aeroplane on the ground must be such as to becomes incapacitated.
preclude damage to the steering system.
(e) Unless the nose-wheel, when lowered, is
CS 25.773 Pilot compartment view
automatically in the fore-and-aft attitude successful
landings must be demonstrated with the nose-wheel (a) Non-precipitation conditions. For non-
initially in all possible off-centre positions. precipitation conditions, the following apply:
(1) Each pilot compartment must be
PERSONNEL AND CARGO
arranged to give the pilots a sufficiently
ACCOMMODATIONS
extensive, clear, and undistorted view, to enable
them to safely perform any manoeuvres within
CS 25.771 Pilot compartment
the operating limitations of the aeroplane,
(a) Each pilot compartment and its equipment including taxiing, take-off, approach and
must allow the minimum flight crew (established landing.
under CS 25.1523) to perform their duties without
(2) Each pilot compartment must be free
unreasonable concentration or fatigue.
of glare and reflection that could interfere with
(b) The primary controls listed in CS 25.779 the normal duties of the minimum flight crew
(a), excluding cables and control rods, must be (established under CS 25.1523). This must be
located with respect to the propellers so that no shown in day and night flight tests under non-
member of the minimum flight crew (established precipitation conditions.
under CS 25.1523), or part of the controls, lies in
(b) Precipitation conditions. For precipitation
the region between the plane of rotation of any
conditions, the following apply:
inboard propeller and the surface generated by a
line passing through the centre of the propeller hub (1) The aeroplane must have a means to
making an angle of 5º forward or aft of the plane of maintain a clear portion of the windshield during
rotation of the propeller. precipitation conditions, sufficient for both
pilots to have a sufficiently extensive view along
(c) If provision is made for a second pilot, the
the flight path in normal flight attitudes of the
aeroplane must be controllable with equal safety
aeroplane. This means must be designed to
from either pilot seat.
function, without continuous attention on the
(d) The pilot compartment must be part of the crew, in –
constructed so that, when flying in rain or snow, it
(i) Heavy rain at speeds up to 1·5
will not leak in a manner that will distract the crew
VSR1, with lift and drag devices retracted;
or harm the structure.
and
(e) Vibration and noise characteristics of
(ii) The icing conditions specified
cockpit equipment may not interfere with safe
in CS 25.1419 if certification with ice
operation of the aeroplane.
protection provisions is requested. (See
AMC 25.773(b)(1)(ii).)
CS 25.772 Pilot compartment doors (2) No single failure of the systems used
to provide the view required by sub-paragraph
For an aeroplane that has a lockable door
(b)(1) of this paragraph must cause the loss of
installed between the pilot compartment and the
that view by both pilots in the specified
passenger compartment: -
precipitation conditions.
1-D-12
BOOK 1 CS-25
(3) The first pilot must have – the danger to the pilots from flying windshield
fragments due to bird impact. This must be shown
(i) A window that is openable
for each transparent pane in the cockpit that –
under the conditions prescribed in sub-
paragraph (b)(1) of this paragraph when (1) Appears in the front view of the
the cabin is not pressurised, provides the aeroplane;
view specified in that paragraph, and gives
(2) Is inclined 15º or more to the
sufficient protection from the elements
longitudinal axis of the aeroplane; and
against impairment of the pilot’s vision; or
(3) Has any part of the pane located
(ii) An alternative means to
where its fragmentation will constitute a hazard
maintain a clear view under the conditions
to the pilots.
specified in sub-paragraph (b)(1) of this
paragraph, considering the probable (d) The design of windshields and windows in
damage due to a severe hail encounter. pressurised aeroplanes must be based on factors
peculiar to high altitude operation, including the
(4) The openable window specified in
effects of continuous and cyclic pressurisation
sub-paragraph (b)(3) of this paragraph need not
loadings, the inherent characteristics of the material
be provided if it is shown that an area of the
used, and the effects of temperatures and
transparent surface will remain clear sufficient
temperature differentials. The windshield and
for at least one pilot to land the aeroplane safely
window panels must be capable of withstanding the
in the event of -
maximum cabin pressure differential loads
(i) Any system failure or combination combined with critical aerodynamic pressure and
of failures, which is not, Extremely Improbable temperature effects after any single failure in the
under the precipitation conditions specified in sub- installation or associated systems. It may be
paragraph (b)(1) of this paragraph. assumed that, after a single failure that is obvious to
the flight crew (established under CS 25.1523), the
(ii) An encounter with hail, birds, or
cabin pressure differential is reduced from the
insects.
maximum, in accordance with appropriate operating
(c) Internal windshield and window fogging. limitations, to allow continued safe flight of the
The aeroplane must have a means to prevent aeroplane with a cabin pressure altitude of not more
fogging to the internal portions of the windshield than 4572m (15 000 ft) (see AMC 25.775 (d)).
and window panels over an area which would
(e) The windshield panels in front of the pilots
provide the visibility specified in sub-paragraph (a)
must be arranged so that, assuming the loss of
of this paragraph under all internal and external
vision through any one panel, one or more panels
ambient conditions, including precipitation
remain available for use by a pilot seated at a pilot
conditions, in which the aeroplane is intended to be
station to permit continued safe flight and landing.
operated.
(d) Fixed markers or other guides must be
installed at each pilot station to enable the pilots to CS 25.777 Cockpit controls
position themselves in their seats for an optimum
(a) Each cockpit control must be located to
combination of outside visibility and instrument
provide convenient operation and to prevent
scan. If lighted markers or guides are used they
confusion and inadvertent operation.
must comply with the requirements specified in CS
25.1381. (b) The direction of movement of cockpit
controls must meet the requirements of CS 25.779.
Wherever practicable, the sense of motion involved
CS 25.775 Windshields and windows in the operation of other controls must correspond
to the sense of the effect of the operation upon the
(a) Internal panes must be made of non-
aeroplane or upon the part operated. Controls of a
splintering material.
variable nature using a rotary motion must move
(b) Windshield panes directly in front of the clockwise from the off position, through an
pilots in the normal conduct of their duties, and the increasing range, to the full on position.
supporting structures for these panes, must
(c) The controls must be located and arranged,
withstand, without penetration, the bird impact
with respect to the pilots' seats, so that there is full
conditions specified in CS 25.631.
and unrestricted movement of each control without
(c) Unless it can be shown by analysis or tests interference from the cockpit structure or the
that the probability of occurrence of a critical clothing of the minimum flight crew (established
windshield fragmentation condition is of a low under CS 25.1523) when any member of this flight
order, the aeroplane must have a means to minimise crew from 1.58 m (5ft 2 inches) to 1·91 m (6ft 3
1-D-13
CS-25 BOOK 1
inches) in height, is seated with the seat belt and (2) Secondary.
shoulder harness (if provided) fastened.
Controls Motion and effect
(d) Identical powerplant controls for each
engine must be located to prevent confusion as to
Flaps (or Forward for wing-flaps up;
the engines they control.
auxiliary lift rearward for flaps down
(e) Wing-flap controls and other auxiliary lift devices)
device controls must be located on top of the
pedestal, aft of the throttles, centrally or to the right Trim tabs (or Rotate to produce similar
of the pedestal centre line, and not less than 25 cm equivalent) rotation of the aeroplane about
(10 inches) aft of the landing gear control. an axis parallel to the axis of
the control
(f) The landing gear control must be located
forward of the throttles and must be operable by
(b) Powerplant and auxiliary controls –
each pilot when seated with seat belt and shoulder
harness (if provided) fastened. (1) Powerplant.
(g) Control knobs must be shaped in
Controls Motion and effect
accordance with CS 25.781. In addition, the knobs
must be of the same colour and this colour must
Power or Forward to increase forward
contrast with the colour of control knobs for other
thrust thrust and rearward to increase
purposes and the surrounding cockpit.
rearward thrust
(h) If a flight engineer is required as part of
the minimum flight crew (established under CS Propellers Forward to increase rpm
25.1523), the aeroplane must have a flight engineer
station located and arranged so that the flight-crew (2) Auxiliary.
members can perform their functions efficiently and
without interfering with each other. Controls Motion and effect
1-D-14
BOOK 1 CS-25
1-D-15
CS-25 BOOK 1
(i) If an integral stair is installed in a (e) Each berth must be designed so that the
passenger entry door that is qualified as a passenger forward part has a padded end board, canvas
emergency exit, the stair must be designed so that diaphragm, or equivalent means, that can withstand
under the following conditions the effectiveness of the static load reaction of the occupant when
passenger emergency egress will not be impaired: subjected to the forward inertia force specified in
CS 25.561. Berths must be free from corners and
(1) The door, integral stair, and
protuberances likely to cause injury to a person
operating mechanism have been subjected to the
occupying the berth during emergency conditions.
inertia forces specified in CS 25.561(b)(3),
acting separately relative to the surrounding (f) Each seat or berth, and its supporting
structure. structure, and each safety belt or harness and its
anchorage must be designed for an occupant weight
(2) The aeroplane is in the normal
of 77 kg (170 pounds), considering the maximum
ground attitude and in each of the attitudes
load factors, inertia forces, and reactions among the
corresponding to collapse of one or more legs of
occupant, seat, safety belt, and harness for each
the landing gear.
relevant flight and ground load condition (including
(j) All lavatory doors must be designed to the emergency landing conditions prescribed in CS
preclude anyone from becoming trapped inside the 25.561). In addition –
lavatory, and if a locking mechanism is installed, it
(1) The structural analysis and testing of
must be capable of being unlocked from the outside
the seats, berths, and their supporting structures
without the aid of special tools.
may be determined by assuming that the critical
load in the forward, sideward, downward,
upward, and rearward directions (as determined
CS 25.785 Seats, berths, safety belts
from the prescribed flight, ground, and
and harnesses
emergency landing conditions) acts separately or
(a) A seat (or berth for a non-ambulant using selected combinations of loads if the
person) must be provided for each occupant who required strength in each specified direction is
has reached his or her second birthday. substantiated. The forward load factor need not
be applied to safety belts for berths.
(b) Each seat, berth, safety belt, harness, and
adjacent part of the aeroplane at each station (2) Each pilot seat must be designed for
designated as occupiable during take-off and the reactions resulting from the application of
landing must be designed so that a person making the pilot forces prescribed in CS 25.395.
proper use of these facilities will not suffer serious
(3) For the determination of the strength
injury in an emergency landing as a result of the
of the local attachments (see AMC 25.561(c)) of
inertia forces specified in CS 25.561 and CS
–
25.562.
(i) Each seat to the structure; and
(c) Each seat or berth must be approved.
(ii) Each belt or harness to the seat
(d) Each occupant of a seat (see AMC
or structure; a multiplication factor of 1·33
25.785(d)) that makes more than an 18-degree angle
instead of the fitting factor as defined in
with the vertical plane containing the aeroplane
CS 25.625 should be used for the inertia
centreline must be protected from head injury by a
forces specified in CS 25.561. (For the
safety belt and an energy absorbing rest that will
lateral forces according to CS 25.561(b)(3)
support the arms, shoulders, head and spine, or by a
1·33 times 3·0 g should be used.)
safety belt and shoulder harness that will prevent
the head from contacting any injurious object. (g) Each crewmember seat at a flight-deck
Each occupant of any other seat must be protected station must have a shoulder harness. These seats
from head injury by a safety belt and, as must meet the strength requirements of sub-
appropriate to the type, location, and angle of paragraph (f) of this paragraph, except that where a
facing of each seat, by one or more of the seat forms part of the load path, the safety belt or
following: shoulder harness attachments need only be proved
to be not less strong than the actual strength of the
(1) A shoulder harness that will prevent
seat. (See AMC 25.785 (g).)
the head from contacting any injurious object.
(h) Each seat located in the passenger
(2) The elimination of any injurious
compartment and designated for use during take-off
object within striking radius of the head.
and landing by a cabin crewmember required by the
(3) An energy absorbing rest that will Operating Rules must be –
support the arms, shoulders, head and spine.
1-D-16
BOOK 1 CS-25
(1) Near a required floor level (1) Cause direct injury to occupants;
emergency exit, except that another location is
(2) Penetrate fuel tanks or lines or cause
acceptable if the emergency egress of passengers
fire or explosion hazard by damage to adjacent
would be enhanced with that location. A cabin
systems; or
crewmember seat must be located adjacent to
each Type A emergency exit. Other cabin (3) Nullify any of the escape facilities
crewmember seats must be evenly distributed provided for use after an emergency landing, to
among the required floor level emergency exits the emergency landing conditions of CS 25.561
to the extent feasible. (b) (3).
(2) To the extent possible, without If the aeroplane has a passenger-seating
compromising proximity to a required floor level configuration, excluding pilot seats, of 10 seats or
emergency exit, located to provide a direct view more, each stowage compartment in the passenger
of the cabin area for which the cabin cabin, except for under seat and overhead
crewmember is responsible. compartments for passenger convenience, must be
completely enclosed.
(3) Positioned so that the seat will not
interfere with the use of a passageway or exit (b) There must be a means to prevent the
when the seat is not in use. contents in the compartments from becoming a
hazard by shifting, under the loads specified in sub-
(4) Located to minimise the probability
paragraph (a) of this paragraph. (See AMC 25.787
that occupants would suffer injury by being
(b).)
struck by items dislodged from service areas,
stowage compartments, or service equipment. (c) If cargo compartment lamps are installed,
each lamp must be installed so as to prevent contact
(5) Either forward or rearward facing
between lamp bulb and cargo.
with an energy absorbing rest that is designed to
support the arms, shoulders, head and spine.
(6) Equipped with a restraint system CS 25.789 Retention of items of mass in
consisting of a combined safety belt and passenger and crew
shoulder harness unit with a single point release. compartments and galleys
There must be means to secure each restraint
(a) Means must be provided to prevent each
system when not in use to prevent interference
item of mass (that is part of the aeroplane type
with rapid egress in an emergency.
design) in a passenger or crew compartment or
(i) Each safety belt must be equipped with a galley from becoming a hazard by shifting under
metal-to-metal latching device. the appropriate maximum load factors
corresponding to the specified flight and ground
(j) If the seat backs do not provide a firm
load conditions, and to the emergency landing
handhold, there must be a handgrip or rail along
conditions of CS 25.561(b).
each aisle to enable persons to steady themselves
while using the aisles in moderately rough air. (b) Each interphone restraint system must be
designed so that when subjected to the load factors
(k) Each projecting object that would injure
specified in CS 25.561 (b)(3), the interphone will
persons seated or moving about the aeroplane in
remain in its stowed position.
normal flight must be padded.
(l) Each forward observer’s seat required by
the operating rules must be shown to be suitable for CS 25.791 Passenger information signs
use in conducting the necessary en-route and placards
inspections. (See AMC 25.791)
(a) If smoking is to be prohibited, there must
be at least one placard so stating that is legible to
CS 25.787 Stowage compartments
each person seated in the cabin. If smoking is to be
(a) Each compartment for the stowage of allowed, and if the crew compartment is separated
cargo, baggage, carry-on articles and equipment from the passenger compartment, there must be at
(such as life rafts) and any other stowage least one sign notifying when smoking is
compartment must be designed for its placarded prohibited. Signs, which notify when smoking is
maximum weight of contents and for the critical prohibited, must be installed so as to be operable
load distribution at the appropriate maximum load from either pilot’s seat and, when illuminated, must
factors corresponding to the specified flight and be legible under all probable conditions of cabin
ground load conditions and, where the breaking illumination to each person seated in the cabin.
loose of the contents of such compartments could–
1-D-17
CS-25 BOOK 1
(b) Signs that notify when seat belts should be grain) and reference velocity 436 m/s
fastened and that are installed to comply with the (1,430 ft/s)
Operating Rules must be installed so as to be
operable from either pilot’s seat and, when
illuminated, must be legible under all probable
conditions of cabin illumination to each person EMERGENCY PROVISIONS
seated in the cabin.
CS 25.801 Ditching
(c) A placard must be located on or adjacent
to the door of each receptacle used for the disposal (a) If certification with ditching provisions is
of flammable waste materials to indicate that use of requested, the aeroplane must meet the
the receptacle for disposal of cigarettes, etc., is requirements of this paragraph and CS 25.807(e),
prohibited. 25.1411 and 25.1415(a).
(d) Lavatories must have ‘No Smoking’ or (b) Each practicable design measure,
‘No Smoking in Lavatory’ placards positioned compatible with the general characteristics of the
adjacent to each ashtray. The placards must have aeroplane, must be taken to minimise the
red letters at least 13 mm (0·5 inches) high on a probability that in an emergency landing on water,
white background of at least 25 mm (1·0 inches) the behaviour of the aeroplane would cause
high. (A No Smoking symbol may be included on immediate injury to the occupants or would make it
the placard.) impossible for them to escape.
(e) Symbols that clearly express the intent of (c) The probable behaviour of the aeroplane in
the sign or placard may be used in lieu of letters. a water landing must be investigated by model tests
or by comparison with aeroplanes of similar
configuration for which the ditching characteristics
CS 25.793 Floor surfaces are known. Scoops, wing-flaps, projections, and
any other factor likely to affect the hydrodynamic
The floor surface of all areas, which are likely to
characteristics of the aeroplane, must be considered.
become wet in service, must have slip resistant
properties. (d) It must be shown that, under reasonably
probable water conditions, the flotation time and
trim of the aeroplane will allow the occupants to
CS 25.795 Security considerations. leave the aeroplane and enter the life rafts required
(see AMC 25.795) by CS 25.1415. If compliance with this provision
is shown by buoyancy and trim computations,
(a) Protection of flightdeck. If a secure appropriate allowances must be made for probable
flightdeck door is required by operating rules, the structural damage and leakage. If the aeroplane has
door installation must be designed to: fuel tanks (with fuel jettisoning provisions) that can
reasonably be expected to withstand a ditching
(1) Resist forcible intrusion by without leakage, the jettisonable volume of fuel
unauthorized persons and be capable of may be considered as buoyancy volume.
withstanding impacts of 300 Joules (221.3 foot-
(e) Unless the effects of the collapse of
pounds) at the critical locations on the door, as
external doors and windows are accounted for in
well as a 1113 Newton (250 pound) constant
the investigation of the probable behaviour of the
tensile load on the knob or handle (See AMC
aeroplane in a water landing (as prescribed in sub-
25.795(a)(1)), and
paragraphs (c) and (d) of this paragraph), the
external doors and windows must be designed to
(2) Resist penetration by small arms fire
withstand the probable maximum local pressures.
and fragmentation devices by meeting the
following projectile definitions and projectile
speeds (See AMC 25.795(a)(2)).
1-D-18
BOOK 1 CS-25
1-D-19
CS-25 BOOK 1
1-D-20
BOOK 1 CS-25
least the dimensions of a Type III exit for each (c) The means of opening emergency exits
unit (or part of a unit) of 35 passenger seats, but must be simple and obvious and may not require
no less than two such exits in the passenger exceptional effort. Internal exit opening means
cabin, with one on each side of the aeroplane. involving sequence operations (such as operation of
The passenger seat/exit ratio may be increased two handles or latches or the release of safety
through the use of larger exits, or other means, catches) may be used for flight crew emergency
provided it is shown that the evacuation exits if it can be reasonably established that these
capability during ditching has been improved means are simple and obvious to crewmembers
accordingly. trained in their use.
(3) If it is impractical to locate side (d) If a single power-boost or single power-
exits above the waterline, the side exits must be operated system is the primary system for operating
replaced by an equal number of readily more than one exit in an emergency, each exit must
accessible overhead hatches of not less than the be capable of meeting the requirements of sub-
dimensions of a Type III exit, except that for paragraph (b) of this paragraph in the event of
aeroplanes with a passenger configuration of 35 failure of the primary system. Manual operation of
seats or less, excluding pilots seats, the two the exit (after failure of the primary system) is
required Type III side exits need be replaced by acceptable.
only one overhead hatch.
(e) Each emergency exit must be shown by
(f) Flight crew emergency exits. For tests, or by a combination of analysis and tests, to
aeroplanes in which the proximity of passenger meet the requirements of sub-paragraphs (b) and (c)
emergency exits to the flight crew area does not of this paragraph.
offer a convenient and readily accessible means of
(f) There must be a means to lock each
evacuation of the flight crew, and for all aeroplanes
emergency exit and to safeguard against its opening
having a passenger seating capacity greater than 20,
in flight, either inadvertently by persons or as a
flight crew exits must be located in the flight crew
result of mechanical failure. In addition, there must
area. Such exits must be of sufficient size and so
be a means for direct visual inspection of the
located as to permit rapid evacuation by the crew.
locking mechanism by crewmembers to determine
One exit must be provided on each side of the
that each emergency exit, for which the initial
aeroplane; or, alternatively, a top hatch must be
opening movement is outward, is fully locked.
provided. Each exit must encompass an
unobstructed rectangular opening of at least 48 by (g) There must be provisions to minimise the
51 cm (19 by 20 inches) unless satisfactory exit probability of jamming of the emergency exits
utility can be demonstrated by a typical resulting from fuselage deformation in a minor
crewmember. crash landing.
1-D-21
CS-25 BOOK 1
emergency exit which is also a passenger (b) Assist means from the cabin to the wing
entrance door or a service door must be are required for each Type A exit located above the
provided with means to prevent wing and having a step-down unless the exit
deployment of the assisting means when it without an assist means can be shown to have a rate
is opened from either the inside or the of passenger egress at least equal to that of the
outside under non-emergency conditions same type of non-over-wing exit. If an assist means
for normal use. is required, it must be automatically deployed and
automatically erected, concurrent with the opening
(ii) It must be automatically
of the exit and self-supporting within 10 seconds.
erected within 10 seconds after
deployment is begun. (c) An escape route must be established from
each over-wing emergency exit, and (except for
(iii) It must be of such length after
flap surfaces suitable as slides) covered with a slip
full deployment that the lower end is self-
resistant surface. Except where a means for
supporting on the ground and provides
channelling the flow of evacuees is provided –
safe evacuation of occupants to the ground
after collapse of one or more legs of the (1) The escape route must be at least
landing gear. 1·07 m (42 inches) wide at Type A passenger
emergency exits and must be at least 61 cm (2
(iv) It must have the capability, in
feet) wide at all other passenger emergency
46 km/hr (25-knot) winds directed from
exits, and
the most critical angle, to deploy and, with
the assistance of only one person, to (2) The escape route surface must have
remain usable after full deployment to a reflectance of at least 80%, and must be
evacuate occupants safely to the ground. defined by markings with a surface-to-marking
contrast ratio of at least 5:1. (See AMC 25.810
(v) For each system installation
(c) (2).)
(mock-up or aeroplane installed), five
consecutive deployment and inflation tests (d) If the place on the aeroplane structure at
must be conducted (per exit) without which the escape route required in sub-paragraph
failure, and at least three tests of each such (c) of this paragraph terminates, is more than 1·8 m
five-test series must be conducted using a (6 feet) from the ground with the aeroplane on the
single representative sample of the device. ground and the landing gear extended, means to
The sample devices must be deployed and reach the ground must be provided to assist
inflated by the system’s primary means evacuees who have used the escape route. If the
after being subjected to the inertia forces escape route is over a flap, the height of the
specified in CS 25.561(b). If any part of terminal edge must be measured with the flap in the
the system fails or does not function take-off or landing position, whichever is higher
properly during the required tests, the from the ground. The assisting means must be
cause of the failure or malfunction must be usable and self-supporting with one or more landing
corrected by positive means and after that, gear legs collapsed and under a 46 km/hr (25-knot)
the full series of five consecutive wind directed from the most critical angle. The
deployment and inflation tests must be assisting means provided for each escape route
conducted without failure. leading from a Type A emergency exit must be
capable of carrying simultaneously two parallel
(2) The assisting means for flight crew
lines of evacuees. For other than Type A exits, the
emergency exits may be a rope or any other
assist means must be capable of carrying
means demonstrated to be suitable for the
simultaneously as many parallel lines of evacuees
purpose. If the assisting means is a rope, or an
as there are required escape routes.
approved device equivalent to a rope, it must
be–
(i) Attached to the fuselage CS 25.811 Emergency exit marking
structure at or above the top of the
(a) Each passenger emergency exit, its means
emergency exit opening, or, for a device at
of access, and its means of opening must be
a pilot’s emergency exit window, at
conspicuously marked.
another approved location if the stowed
device, or its attachment, would reduce the (b) The identity and location of each
pilot’s view in flight. passenger emergency exit must be recognisable
from a distance equal to the width of the cabin.
(ii) Able (with its attachment) to
withstand a 1779 N (400-lbf) static load.
1-D-22
BOOK 1 CS-25
(c) Means must be provided to assist the provides adequate contrast. (See AMC 25.811
occupants in locating the exits in conditions of (e) (4).)
dense smoke.
(f) Each emergency exit that is required to be
(d) The location of each passenger emergency openable from the outside, and its means of
exit must be indicated by a sign visible to occupants opening, must be marked on the outside of the
approaching along the main passenger aisle (or aeroplane. In addition, the following apply:
aisles). There must be –
(1) The outside marking for each
(1) A passenger emergency exit locator passenger emergency exit in the side of the
sign above the aisle (or aisles) near each fuselage must include a 51 mm (2 inch) coloured
passenger emergency exit, or at another band outlining the exit.
overhead location if it is more practical because
(2) Each outside marking including the
of low headroom, except that one sign may serve
band must have colour contrast to be readily
more than one exit if each exit can be seen
distinguishable from the surrounding fuselage
readily from the sign;
surface. The contrast must be such that if the
(2) A passenger emergency exit marking reflectance of the darker colour is 15% or less,
sign next to each passenger emergency exit, the reflectance of the lighter colour must be at
except that one sign may serve two such exits if least 45%. ‘Reflectance’ is the ratio of the
they both can be seen readily from the sign; and luminous flux reflected by a body to the
luminous flux it receives. When the reflectance
(3) A sign on each bulkhead or divider
of the darker colour is greater than 15%, at least
that prevents fore and aft vision along the
a 30% difference between its reflectance and the
passenger cabin to indicate emergency exits
reflectance of the lighter colour must be
beyond and obscured by the bulkhead or divider,
provided.
except that if this is not possible the sign may be
placed at another appropriate location. (3) In the case of exits other than those
in the side of the fuselage, such as ventral or tail
(e) The location of the operating handle and
cone exits, the external means of opening,
instructions for opening exits from the inside of the
including instructions if applicable, must be
aeroplane must be shown in the following manner:
conspicuously marked in red, or bright chrome
(1) Each passenger emergency exit must yellow if the background colour is such that red
have, on or near the exit, a marking that is is inconspicuous. When the opening means is
readable from a distance of 76 cm (30 inches). located on only one side of the fuselage, a
conspicuous marking to that effect must be
(2) Each passenger emergency exit
provided on the other side.
operating handle and the cover removal
instructions, if the operating handle is covered, (g) Each sign required by sub-paragraph (d) of
must – this paragraph may use the word ‘exit’ in its legend
in place of the term ‘emergency exit’.
(i) Be self-illuminated with an
initial brightness of at least 0.51
candela/m2 (160 microlamberts), or
CS 25.812 Emergency lighting
(ii) Be conspicuously located and (See AMC 25.812)
well illuminated by the emergency lighting
(a) An emergency lighting system,
even in conditions of occupant crowding at
independent of the main lighting system, must be
the exit.
installed. However, the sources of general cabin
(3) Reserved illumination may be common to both the emergency
and the main lighting systems if the power supply
(4) All Type II and larger passenger
to the emergency lighting system is independent of
emergency exits with a locking mechanism
the power supply to the main lighting system. The
released by motion of a handle, must be marked
emergency lighting system must include-
by a red arrow with a shaft at least 19 mm (0.75
inches) wide, adjacent to the handle, that (1) Illuminated emergency exit marking
indicates the full extent and direction of the and locating signs, sources of general cabin
unlocking motion required. The word OPEN illumination, interior lighting in emergency exit
must be horizontally situated adjacent to the areas, and floor proximity escape path marking.
arrowhead and must be in red capital letters at
(2) Exterior emergency lighting.
least 25 mm (1 inch) high. The arrow and word
OPEN must be located on a background, which (b) Emergency exit signs –
1-D-23
CS-25 BOOK 1
(1) For aeroplanes that have a passenger emergency exit or cabin occupant seat,
passenger-seating configuration, excluding pilot whichever is farther aft.
seats, of 10 seats or more must meet the
(d) The floor of the passageway leading to
following requirements:
each floor-level passenger emergency exit, between
(i) Each passenger emergency the main aisles and the exit openings, must be
exit locator sign required by CS 25.811 provided with illumination that is not less than 0.2
(d)(1) and each passenger emergency exit lux (0.02 foot candle) measured along a line that is
marking sign required by CS 25.811(d)(2) within 15 cm (6 inches) of and parallel to the floor
must have red letters at least 38 mm (1·5 and is centred on the passenger evacuation path.
inches) high on an illuminated white
(e) Floor proximity emergency escape path
background, and must have an area of at
marking must provide emergency evacuation
least 135 cm2 (21 square inches) excluding
guidance for passengers when all sources of
the letters. The lighted background-to-
illumination more than 1.2 m (4 ft) above the cabin
letter contrast must be at least 10:1. The
aisle floor are totally obscured. In the dark of the
letter height to stroke-width ratio may not
night, the floor proximity emergency escape path
be more than 7:1 nor less than 6:1. These
marking must enable each passenger to –
signs must be internally electrically
illuminated with a background brightness (1) After leaving the passenger seat,
of at least 86 candela/m2 (25 foot visually identify the emergency escape path
lamberts) and a high-to-low background along the cabin aisle floor to the first exits or
contrast no greater than 3:1. pair of exits forward and aft of the seat; and
(ii) Each passenger emergency (2) Readily identify each exit from the
exit sign required by CS 25.811(d)(3) must emergency escape path by reference only to
have red letters at least 38 mm (1·5 inches) markings and visual features not more than
high on a white background having an area 1.2 m (4 ft) above the cabin floor.
of at least 135 cm2 (21 square inches)
(f) Except for sub-systems provided in
excluding the letters. These signs must be
accordance with sub-paragraph (h) of this
internally electrically illuminated or self-
paragraph that serve no more than one assist means,
illuminated by other than electrical means
are independent of the aeroplane’s main emergency
and must have an initial brightness of at
lighting system, and are automatically activated
least 1.27 candela/m2 (400 microlamberts).
when the assist means is erected, the emergency
The colours may be reversed in the case of
lighting system must be designed as follows:
a sign that is self-illuminated by other than
electrical means. (1) The lights must be operable
manually from the flight crew station and from a
(2) For aeroplanes that have a passenger
point in the passenger compartment that is
seating configuration, excluding pilot seats, of 9
readily accessible to a normal cabin
seats or less, that are required by CS 25.811
crewmember seat.
(d)(1), (2), and (3) must have red letters at least
25 mm (1 inch) high on a white background at (2) There must be a flight crew warning
least 51 mm (2 inches) high. These signs may light, which illuminates when power is on in the
be internally electrically illuminated, or self- aeroplane and the emergency lighting control
illuminated by other than electrical means, with device is not armed.
an initial brightness of at least 0.51 candela/m2
(3) The cockpit control device must
(160 microlamberts). The colours may be
have an ‘on’, ‘off’ and ‘armed’ position so that
reversed in the case of a sign that is self-
when armed in the cockpit or turned on at either
illuminated by other than electrical means.
the cockpit or cabin crew member station the
(c) General illumination in the passenger lights will either light or remain lighted upon
cabin must be provided so that when measured interruption (except an interruption caused by a
along the centreline of main passenger aisle(s), and transverse vertical separation of the fuselage
cross aisle(s) between main aisles, at seat armrest during crash landing) of the aeroplane’s normal
height and at 1.02 m (40-inch) intervals, the electric power. There must be a means to
average illumination is not less than 0.5 lux (0.05 safeguard against inadvertent operation of the
foot candle) and the illumination at each 1.02 m control device from the ‘armed’ or ‘on’
(40-inch) interval is not less than 0.1 lux (0.01 foot positions.
candle). A main passenger aisle(s) is considered to
(g) Exterior emergency lighting must be
extend along the fuselage from the most forward
provided as follows:
passenger emergency exit or cabin occupant seat,
whichever is farther forward, to the most rearward
1-D-24
BOOK 1 CS-25
1-D-25
CS-25 BOOK 1
affords a more effective means of passenger unobstructed. However, curtains may be used if
evacuation. Where more than one floor level exit they allow free entry through the passageway.
per side is prescribed, at least one floor level exit
(e) No door may be installed in any partition
per side must be located near each end of the cabin,
between passenger compartments.
except that this provision does not apply to
combination cargo/passenger configuration. In (f) If it is necessary to pass through a
addition – doorway separating the passenger cabin from other
areas to reach any required emergency exit from
(a) There must be a passageway leading from
any passenger seat, the door must have a means to
each main aisle to each Type I, Type II, or Type A
latch it in open position. The latching means must
emergency exit and between individual passenger
be able to withstand the loads imposed upon it
areas. If two or more main aisles are provided,
when the door is subjected to the ultimate inertia
there must be a cross aisle leading directly to each
forces, relative to the surrounding structure, listed
passageway between the exit and the nearest main
in CS 25.561 (b).
aisle. Each passageway leading to a Type A exit
must be unobstructed and at least 91 cm (36 inches)
wide. Other passageways and cross aisles must be
CS 25.815 Width of aisle
unobstructed and at least 51 cm (20 inches) wide.
(See AMC 25.815)
Unless there are two or more main aisles, each
Type A exit must be located so that there is The passenger aisle width at any point between
passenger flow along the main aisle to that exit seats must equal or exceed the values in the
from both the forward and aft directions. following table:
(b) Adequate space to allow crew-member(s)
to assist in the evacuation of passengers must be Minimum passenger aisle
provided as follows: width (cm (inches))
Passenger seating Less than 64 cm
(1) The assist space must not reduce the
capacity 64 cm (25
unobstructed width of the passageway below
(25 inches) inches)
that required for the exit. from floor and more
(2) For each Type A exit, assist space from
floor
must be provided at each side of the exit
regardless of whether the exit is covered by CS 10 or less 30 (12)* 38 (15)
25.810(a). 11 to 19 30 (12) 51 (20)
(3) For any other type exit that is 20 or more 38 (15) 51 (20)
covered by CS 25.810(a), space must at least be
provided at one side of the passageway. * A narrower width not less than 23 cm (9 inches) may be
approved when substantiated by tests found necessary by the
(c) There must be access from each aisle to Agency.
each Type III or Type IV exit, and –
(1) For aeroplanes that have a passenger
CS 25.817 Maximum number of seats
seating configuration, excluding pilot’s seats, of
abreast
20 or more, the projected opening of the exit
provided may not be obstructed and there must On aeroplanes having only one passenger aisle, no
be no interference in opening the exit by seats, more than 3 seats abreast may be placed on each
berths, or other protrusions (including seatbacks side of the aisle in any one row.
in any position) for a distance from that exit not
less than the width of the narrowest passenger
seat installed on the aeroplane. CS 25.819 Lower deck service
compartments (including
(2) For aeroplanes that have a passenger
galleys)
seating configuration, excluding pilot’s seats, of
19 or less, there may be minor obstructions in For aeroplanes with a service compartment located
this region, if there are compensating factors to below the main deck, which may be occupied
maintain the effectiveness of the exit. during the taxi or flight but not during take-off or
landing, the following apply:
(d) If it is necessary to pass through a
passageway between passenger compartments to (a) There must be at least two emergency
reach any required emergency exit from any seat in evacuation routes, one at each end of each lower
the passenger cabin, the passageway must be deck service compartment or two having sufficient
separation within each compartment, which could
1-D-26
BOOK 1 CS-25
be used by each occupant of the lower deck service that is openable from inside and outside the lift
compartment to rapidly evacuate to the main deck without tools, with the lift in any position.
under normal and emergency lighting conditions.
The routes must provide for the evacuation of
VENTILATION AND HEATING
incapacitated persons, with assistance. The use of
the evacuation routes may not be dependent on any
CS 25.831 Ventilation
powered device. The routes must be designed to
minimise the possibility of blockage, which might (a) Each passenger and crew compartment
result from fire, mechanical or structural failure, or must be ventilated and each crew compartment
persons standing on top of or against the escape must have enough fresh air (but not less than
routes. In the event the aeroplane’s main power 0.28 m3/min. (10 cubic ft per minute) per
system or compartment main lighting system should crewmember) to enable crewmembers to perform
fail, emergency illumination for each lower deck their duties without undue discomfort or fatigue.
service compartment must be automatically (See AMC 25.831 (a).)
provided.
(b) Crew and passenger compartment air must
(b) There must be a means for two-way voice be free from harmful or hazardous concentrations of
communication between the flight deck and each gases or vapours. In meeting this requirement, the
lower deck service compartment, which remains following apply:
available following loss of normal electrical power
(1) Carbon monoxide concentrations in
generating system.
excess of one part in 20 000 parts of air are
(c) There must be an aural emergency alarm considered hazardous. For test purposes, any
system, audible during normal and emergency acceptable carbon monoxide detection method
conditions, to enable crew members on the flight may be used.
deck and at each required floor level emergency
(2) Carbon dioxide concentration during
exit to alert occupants of each lower deck service
flight must be shown not to exceed 0·5% by
compartment of an emergency situation.
volume (sea level equivalent) in compartments
(d) There must be a means, readily detectable normally occupied by passengers or
by occupants of each lower deck service crewmembers. For the purpose of this sub-
compartment that indicates when seat belts should paragraph, “sea level equivalent” refers to
be fastened. conditions of 25° C (77° F) and 1 013·2 hPa
(760 millimetres of mercury) pressure.
(e) If a public address system is installed in
the aeroplane, speakers must be provided in each (c) There must be provisions made to ensure
lower deck service compartment. that the conditions prescribed in sub-paragraph (b)
of this paragraph are met after reasonably probable
(f) For each occupant permitted in a lower
failures or malfunctioning of the ventilating,
deck service compartment, there must be a forward
heating, pressurisation or other systems and
or aft facing seat, which meets the requirements of
equipment. (See AMC 25.831 (c).)
CS 25.785 (d) and must be able to withstand
maximum flight loads when occupied. (d) If accumulation of hazardous quantities of
smoke in the cockpit area is reasonably probable,
(g) For each powered lift system installed
smoke evacuation must be readily accomplished,
between a lower deck service compartment and the
starting with full pressurisation and without de-
main deck for the carriage of persons or equipment,
pressurising beyond safe limits.
or both, the system must meet the following
requirements: (e) Except as provided in sub-paragraph (f) of
this paragraph, means must be provided to enable
(1) Each lift control switch outside the
the occupants of the following compartments and
lift, except emergency stop buttons, must be
areas to control the temperature and quantity of
designed to prevent the activation of the lift if
ventilating air supplied to their compartment or area
the lift door, or the hatch required by sub-
independently of the temperature and quantity of air
paragraph (g) (3) of this paragraph, or both are
supplied to other compartments and areas:
open.
(1) The flight-crew compartment.
(2) An emergency stop button, that
when activated will immediately stop the lift, (2) Crew-member compartments and
must be installed within the lift and at each areas other than the flight-crew compartment
entrance to the lift. unless the crewmember compartment or area is
ventilated by air interchange with other
(3) There must be a hatch capable of
compartments or areas under all operating
being used for evacuating persons from the lift
conditions.
1-D-27
CS-25 BOOK 1
1-D-28
BOOK 1 CS-25
(7) A warning placard at the pilot or located and evenly distributed in passenger
flight engineer station if the structure is not compartments. (See AMC 25.851 (a)(1).):
designed for pressure differentials up to the
maximum relief valve setting in combination Passenger capacity Number of
with landing loads. extinguishers
1-D-29
CS-25 BOOK 1
1-D-30
BOOK 1 CS-25
(c) Ceiling and sidewall liner panels of Class (b) Class B. (See AMC 25.857(b).) A Class
C and D compartments must meet the test B cargo or baggage compartment is one in which –
requirements of Part III of Appendix F or other
(1) There is sufficient access in flight to
approved equivalent methods.
enable a crewmember to effectively reach any
(d) All other materials used in the part of the compartment with the contents of a
construction of the cargo or baggage compartment hand fire extinguisher;
must meet the applicable test criteria prescribed in
(2) When the access provisions are
Part I of Appendix F, or other approved equivalent
being used no hazardous quantity of smoke,
methods.
flames or extinguishing agent will enter any
(e) No compartment may contain any controls, compartment occupied by the crew or
wiring, lines, equipment, or accessories whose passengers; and
damage or failure would affect safe operation,
(3) There is a separate approved smoke
unless those items are protected so that–
detector or fire detector system to give warning
(1) They cannot be damaged by the to the pilot or flight engineer station.
movement of cargo in the compartment; and
(c) Class C. A Class C cargo or baggage
(2) Their breakage or failure will not compartment is one not meeting the requirements
create a fire hazard. for either a Class A or B compartment but in
which–
(f) There must be means to prevent cargo or
baggage from interfering with the functioning of (1) There is a separate approved smoke
the fire protective features of the compartment. detector or fire detector system to give warning
at the pilot or flight engineer station;
(g) Sources of heat within the compartment
must be shielded and insulated to prevent igniting (2) There is an approved built-in fire-
the cargo or baggage. extinguishing or suppression system controllable
from the cockpit.
(h) Flight tests must be conducted to show
compliance with the provisions of CS 25.857 (3) There are means to exclude
concerning – hazardous quantities of smoke, flames, or
extinguishing agent, from any compartment
(1) Compartment accessibility;
occupied by the crew or passengers; and
(2) The entry of hazardous quantities of
(4) There are means to control
smoke or extinguishing agent into compartments
ventilation and draughts within the compartment
occupied by the crew or passengers; and
so that the extinguishing agent used can control
(3) The dissipation of the extinguishing any fire that may start within the compartment.
agent in Class C compartments.
(d) Class D. (See AMC 25.857 (d).) A Class
(i) During the above tests, it must be shown D cargo or baggage compartment is one in which –
that no inadvertent operation of smoke or fire
(1) A fire occurring in it will be
detectors in any compartment would occur as a
completely confined without endangering the
result of fire contained in any other compartment,
safety of the aeroplane or the occupants;
either during or after extinguishment, unless the
extinguishing system floods each such compartment (2) There are means to exclude
simultaneously. hazardous quantities of smoke, flames, or other
noxious gases, from any compartment occupied
by the crew or passengers;
CS 25.857 Cargo compartment
(3) Ventilation and draughts are
classification
controlled within each compartment so that any
(See AMC 25.857)
fire likely to occur in the compartment will not
(a) Class A. A Class A cargo or baggage progress beyond safe limits;
compartment is one in which –
(4) Reserved.
(1) The presence of a fire would be
(5) Consideration is given to the effect
easily discovered by a crew member while at his
of heat within the compartment on adjacent
station; and
critical parts of the aeroplane.
(2) Each part of the compartment is
(6) The compartment volume does not
easily accessible in flight.
exceed 28.32 m3 (1000 cubic ft).
1-D-31
CS-25 BOOK 1
For compartments of 14.16 m3 (500 cubic ft) or (1) The region surrounding the heater, if
less, an airflow of 42.48 m3/hr (1500 cubic ft per this region contains any flammable fluid system
hour) is acceptable. components (excluding the heater fuel system)
that could –
(e) Class E. A Class E cargo compartment is
one on aeroplanes used only for the carriage of (i) Be damaged by heater
cargo and in which – malfunctioning; or
If certification with cargo compartment fire (2) Each part of any ventilating duct
detection provisions is requested, the following passing through any region having a flammable
must be met for each cargo compartment with those fluid system must be constructed or isolated
provisions: from that system so that the malfunctioning of
any component of that system cannot introduce
(a) The detection system must provide a flammable fluids or vapours into the ventilating
visual indication to the flight crew within one airstream.
minute after the start of a fire.
(c) Combustion air ducts. Each combustion
(b) The system must be capable of detecting a air duct must be fireproof for a distance great
fire at a temperature significantly below that at enough to prevent damage from backfiring or
which the structural integrity of the aeroplane is reverse flame propagation. In addition –
substantially decreased.
(1) No combustion air duct may have a
(c) There must be means to allow the crew to common opening with the ventilating airstream
check in flight, the functioning of each fire detector unless flames from backfires or reverse burning
circuit. cannot enter the ventilating airstream under any
operating condition, including reverse flow or
(d) The effectiveness of the detection system
malfunctioning of the heater or its associated
must be shown for all approved operating
components; and
configurations and conditions.
(2) No combustion air duct may restrict
the prompt relief of any backfire that, if so
CS 25.859 Combustion heater fire restricted, could cause heater failure.
protection
(d) Heater controls; general. Provision must
(a) Combustion heater fire zones. The be made to prevent the hazardous accumulation of
following combustion heater fire zones must be water or ice on or in any heater control component,
protected from fire in accordance with the control system tubing, or safety control.
applicable provisions of CS 25.1181 to 25.1191 and
(e) Heater safety controls. For each
25.1195 to 25.1203:
combustion heater there must be the following
safety control means:
1-D-32
BOOK 1 CS-25
(1) Means independent of the (h) Heater fuel systems. Each heater fuel
components provided for the normal continuous system must meet each powerplant fuel system
control of air temperature, airflow, and fuel flow requirement affecting safe heater operation. Each
must be provided, for each heater, to heater fuel system component within the ventilating
automatically shut off the ignition and fuel airstream must be protected by shrouds so that no
supply to that heater at a point remote from that leakage from those components can enter the
heater when any of the following occurs: ventilating airstream.
(i) Drains. There must be means to safely
(i) The heat exchanger
drain fuel that might accumulate within the
temperature exceeds safe limits.
combustion chamber or the heater exchanger. In
(ii) The ventilating air temperature addition –
exceeds safe limits.
(1) Each part of any drain that operates
(iii) The combustion airflow at high temperatures must be protected in the
becomes inadequate for safe operation. same manner as heater exhausts; and
(iv) The ventilating airflow (2) Each drain must be protected from
becomes inadequate for safe operation. hazardous ice accumulation under any operating
conditions.
(2) The means of complying with sub-
paragraph (e) (1) of this paragraph for any
individual heater must –
CS 25.863 Flammable fluid fire
(i) Be independent of components protection
serving any other heater whose heat output
(a) In each area where flammable fluids or
is essential for safe operation; and
vapours might escape by leakage of a fluid system,
(ii) Keep the heater off until there must be means to minimise the probability of
restarted by the crew. ignition of the fluids and vapours, and the resultant
hazards if ignition does occur. (See AMC 25.863
(3) There must be means to warn the
(a).)
crew when any heater whose heat output is
essential for safe operation has been shut off by (b) Compliance with sub-paragraph (a) of this
the automatic means prescribed in sub-paragraph paragraph must be shown by analysis or tests, and
(e) (1) of this paragraph. the following factors must be considered.
(f) Air intakes. Each combustion and (1) Possible sources and paths of fluid
ventilating air intake must be located so that no leakage, and means of detecting leakage.
flammable fluids or vapours can enter the heater
(2) Flammability characteristics of
system under any operating condition –
fluids, including effects of any combustible or
(1) During normal operation; or absorbing materials.
(2) As a result of the malfunctioning of (3) Possible ignition sources, including
any other component. electrical faults, overheating of equipment, and
malfunctioning of protective devices.
(g) Heater exhaust. Heater exhaust systems
must meet the provisions of CS 25.1121 and (4) Means available for controlling or
25.1123. In addition, there must be provisions in extinguishing a fire, such as stopping flow of
the design of the heater exhaust system to safely fluids, shutting down equipment, fireproof
expel the products of combustion to prevent the containment, or use of extinguishing agents.
occurrence of –
(5) Ability of aeroplane components that
(1) Fuel leakage from the exhaust to are critical to safety of flight to withstand fire
surrounding compartments; and heat.
(2) Exhaust gas impingement on (c) If action by the flight crew is required to
surrounding equipment or structure; prevent or counteract a fluid fire (e.g. equipment
(3) Ignition of flammable fluids by the shutdown or actuation of a fire extinguisher) quick
exhaust, if the exhaust is in a compartment acting means must be provided to alert the crew.
containing flammable fluid lines; and (d) Each area where flammable fluids or
(4) Restriction by the exhaust of the vapours might escape by leakage of a fluid system
prompt relief of backfires that, if so restricted, must be identified and defined.
could cause heater failure.
1-D-33
CS-25 BOOK 1
CS 25.865 Fire protection of flight flammable vapours or fluids must meet the
controls, engine mounts, and requirements of CS 25.1183 if the line or fitting is
other flight structure in a designated fire zone. Other vacuum air
systems components in designated fire zones must
Essential flight controls, engine mounts, and
be at least fire resistant.
other flight structures located in designated fire
zones or in adjacent areas which would be (c) (See AMC 25.869(c).) Oxygen equipment
subjected to the effects of fire in the fire zone must and lines must –
be constructed of fireproof material or shielded so
(1) Not be located in any designated fire
that they are capable of withstanding the effects of
zone.
fire.
(2) Be protected from heat that may be
generated in, or escape from, any designated fire
CS 25.867 Fire protection: other zone, and
components
(3) Be installed so that escaping oxygen
(a) Surfaces to the rear of the nacelles, within cannot cause ignition of grease, fluid, or vapour
one nacelle diameter of the nacelle centreline, must accumulations that are present in normal
be constructed of materials at least equivalent in operation or as a result of failure or malfunction
resistance to fire as aluminium alloy in dimensions of any system.
appropriate for the purpose for which they are used.
(b) Sub-paragraph (a) of this paragraph does
not apply to tail surfaces to the rear of the nacelles MISCELLANEOUS
that could not be readily affected by heat, flames,
or sparks coming from a designated fire zone or CS 25.871 Levelling means
engine compartment of any nacelle.
There must be means for determining when the
aeroplane is in a level position on the ground.
CS 25.869 Fire protection: systems
(a) Electrical system components: CS 25.875 Reinforcement near
propellers
(1) Components of the electrical system
must meet the applicable fire and smoke (a) Each part of the aeroplane near the
protection requirements of CS 25.831(c) and CS propeller tips must be strong and stiff enough to
25.863. (See AMC 25.869 (a)(1).) withstand the effects of the induced vibration and
of ice thrown from the propeller.
(2) Electrical cables, terminals, and
equipment in designated fire zones, that are used (b) No window may be near the propeller tips
during emergency procedures, must be at least unless it can withstand the most severe ice impact
fire resistant. likely to occur.
(3) Main power cables (including
generator cables) in the fuselage must be
CS 25.899 Electrical bonding and
designed to allow a reasonable degree of
protection against static
deformation and stretching without failure and
electricity
must be –
(See AMC 25.899)
(i) Isolated from flammable fluid
(a) Electrical bonding and protection against
lines; or
static electricity must be designed to minimise
(ii) Shrouded by means of accumulation of electrostatic charge, which would
electrically insulated, flexible conduit, or cause:
equivalent, which is in addition to the
normal cable insulation. (1) Human injury from electrical shock,
(4) Insulation on electrical wire and
(2) Ignition of flammable vapours, or
electrical cable installed in any area of the
aeroplane must be self-extinguishing when
(3) Interference with installed electrical /
tested in accordance with the applicable portions
electronic equipment.
of Part I, Appendix F.
(b) Each vacuum air system line and fitting on (b) Compliance with sub-paragraph (a) of this
the discharge side of the pump that might contain paragraph may be shown by
1-D-34
BOOK 1 CS-25
1-D-35
CS-25 BOOK 1
1-D-36
BOOK 1 CS-25
SUBPART E – POWERPLANT
1–E–1
CS-25 BOOK 1
CS 25.904 Automatic Takeoff Thrust whichever is most critical. In addition, there must
Control System (ATTCS) be positive clearance between the propeller and
the ground when in the level take-off attitude with
Aeroplanes equipped with an engine power
the critical tyre(s) completely deflated and the
control system that automatically resets the power
corresponding landing gear strut bottomed.
or thrust on the operating engine(s) when any
engine fails during the takeoff must comply with (b) Reserved.
the requirements of Appendix I.
(c) Structural clearance. There must be –
(1) At least 25 mm (1·0 inche) radial
clearance between the blade tips and the
CS 25.905 Propellers
aeroplane structure, plus any additional radial
(a) reserved clearance necessary to prevent harmful
vibration;
(b) Engine power and propeller shaft
rotational speed may not exceed the limits for (2) At least 13 mm (0·5 inches)
which the propeller is certificated. (See CS–P 80.) longitudinal clearance between propeller blades
or cuffs and stationary parts of the aeroplane;
(c) Each component of the propeller blade
and
pitch control system must meet the requirements
of CS–P 200. (3) Positive clearance between other
rotating parts of the propeller or spinner and
(d) Design precautions must be taken to
stationary parts of the aeroplane.
minimise the hazards to the aeroplane in the event
a propeller blade fails or is released by a hub
failure. The hazards which must be considered
CS 25.929 Propeller de-icing
include damage to structure and critical systems
due to impact of a failed or released blade and the (a) For aeroplanes intended for use where
unbalance created by such failure or release. (See icing may be expected, there must be a means to
AMC 25.905 (d).) prevent or remove hazardous ice accumulation on
propellers or on accessories where ice
accumulation would jeopardise engine perfor-
CS 25.907 Propeller vibration mance.
(See CS–P 190.)
(b) If combustible fluid is used for propeller
(a) The magnitude of the propeller blade de-icing, CS 25.1181 to CS 25.1185 and CS
vibration stresses under any normal condition of 25.1189 apply.
operation must be determined by actual
measurement or by comparison with similar
installations for which these measurements have CS 25.933 Reversing systems
been made.
(a) For turbojet reversing systems -
(b) The determined vibration stresses may not
(1) Each system intended for ground
exceed values that have been shown to be safe for
operation only must be designed so that during
continuous operation.
any reversal in flight the engine will produce
no more than flight idle thrust. In addition, it
must be shown by analysis or test, or both, that-
CS 25.925 Propeller clearance
(i) Each operable reverser can be
Unless smaller clearances are substantiated, restored to the forward thrust position;
propeller clearances with the aeroplane at and
maximum weight, with the most adverse centre of
(ii) The aeroplane is capable of
gravity, and with the propeller in the most adverse
continued safe flight and landing under
pitch position, may not be less than the following:
any possible position of the thrust
(a) Ground clearance. There must be a reverser.
clearance of at least 18 cm (7 inches) (for each
(2) Each system intended for inflight use
aeroplane with nose wheel landing gear) or (23 cm
must be designed so that no unsafe condition
9 inches (for each aeroplane with tail-wheel
will result during normal operation of the
landing gear) between each propeller and the
system, or from any failure (or reasonably
ground with the landing gear statically deflected
likely combination of failures) of the reversing
and in the level take-off, or taxying attitude,
1–E–2
BOOK 1 CS-25
1–E–3
CS-25 BOOK 1
CS 25.945 Thrust or power augmentation pressure established for proper engine functioning
system under each likely operating condition, including
any manoeuvre for which certification is requested
(a) General. Each fluid injection system
and during which the engine is permitted to be in
must provide a flow of fluid at the rate and
operation.
pressure established for proper engine functioning
under each intended operating condition. If the (b) Each fuel system must be arranged so that
fluid can freeze, fluid freezing may not damage any air which is introduced into the system will
the aeroplane or adversely affect aeroplane not result in –
performance.
(1) Reserved.
(b) Fluid tanks. Each augmentation system
(2) Flameout.
fluid tank must meet the following requirements:
(c) Each fuel system must be capable of
(1) Each tank must be able to withstand
sustained operation throughout its flow and
without failure the vibration, inertia, fluid, and
pressure range with fuel initially saturated with
structural loads that it may be subjected to in
water at 26,7ºC (80ºF) and having 0.20 cm3 (0·75
operation.
cc) of free water per liter (US gallon) added and
(2) The tanks as mounted in the cooled to the most critical condition for icing
aeroplane must be able to withstand without likely to be encountered in operation.
failure or leakage an internal pressure 1·5 times
the maximum operating pressure.
(3) If a vent is provided, the venting CS 25.952 Fuel system analysis and test
must be effective under all normal flight
(a) Proper fuel system functioning under all
conditions.
probable operating conditions must be shown
(4) Reserved. by analysis and those tests found necessary by the
Agency. Tests, if required, must be made using
(5) Each tank must have an expansion
the aeroplane fuel system or a test article that
space of not less than 2% of the tank capacity.
reproduces the operating characteristics of the
It must be impossible to fill the expansion
portion of the fuel system to be tested.
space inadvertently with the aeroplane in the
normal ground attitude. (b) The likely failure of any heat exchanger
using fuel as one of its fluids may not result in a
(c) Augmentation system drains must be
hazardous condition.
designed and located in accordance with CS
25.1455 if –
(1) The augmentation system fluid is
CS 25.953 Fuel system independence
subject to freezing; and
Each fuel system must meet the requirements of
(2) The fluid may be drained in flight or
CS 25.903(b) by –
during ground operation.
(a) Allowing the supply of fuel to each engine
(d) The augmentation liquid tank capacity
through a system independent of each part of the
available for the use of each engine must be large
system supplying fuel to any other engine; or
enough to allow operation of the aeroplane under
the approved procedures for the use of liquid- (b) Any other acceptable method.
augmented power. The computation of liquid
consumption must be based on the maximum
approved rate appropriate for the desired engine CS 25.954 Fuel system lightning
output and must include the effect of temperature protection
on engine performance as well as any other factors
The fuel system must be designed and arranged to
that might vary the amount of liquid required.
prevent the ignition of fuel vapour within the
system (see AMC 25.581, AMC 25.899 and AMC
25.954) by –
FUEL SYSTEM
(a) Direct lightning strikes to areas having a
high probability of stroke attachment;
CS 25.951 General
(b) Swept lightning strokes to areas where
(a) Each fuel system must be constructed and
swept strokes are highly probable; and
arranged to ensure a flow of fuel at a rate and
1–E–4
BOOK 1 CS-25
(c) Corona and streamering at fuel vent evidence of engine malfunction occurs under the
outlets. most adverse fuel feed condition for all intended
operations and flight manoeuvres involving fuel
feeding from that tank. Fuel system component
failures need not be considered.
CS 25.955 Fuel flow
(a) Each fuel system must provide at least
100% of the fuel flow required under each CS 25.961 Fuel system hot weather
intended operating condition and manoeuvre. operation
Compliance must be shown as follows:
(a) The fuel system must perform
(1) Fuel must be delivered to each satisfactorily in hot weather operation. This must
engine at a pressure within the limits specified be shown by showing that the fuel system from the
in the engine type certificate. tank outlets to each engine is pressurised, under
all intended operations, so as to prevent vapour
(2) The quantity of fuel in the tank may
formation, or must be shown by climbing from the
not exceed the amount established as the
altitude of the airport elected by the applicant to
unusable fuel supply for that tank under the
the maximum altitude established as an operating
requirements of CS 25.959 plus that necessary
limitation under CS 25.1527. If a climb test is
to show compliance with this paragraph.
elected, there may be no evidence of vapour lock
(3) Each main pump must be used that or other malfunctioning during the climb test
is necessary for each operating condition and conducted under the following conditions:
attitude for which compliance with this
(1) Reserved.
paragraph is shown, and the appropriate
emergency pump must be substituted for each (2) For turbine engine powered
main pump so used. aeroplanes, the engines must operate at take-off
power for the time interval selected for
(4) If there is a fuel flowmeter, it must
showing the take-off flight path, and at
be blocked and the fuel must flow through the
maximum continuous power for the rest of the
meter or its bypass. (See AMC 25.955(a)(4).)
climb.
(b) If an engine can be supplied with fuel
(3) The weight of the aeroplane must be
from more than one tank, the fuel system must –
the weight with full fuel tanks, minimum crew,
(1) Reserved. and the ballast necessary to maintain the centre
of gravity within allowable limits.
(2) For each engine, in addition to
having appropriate manual switching (4) The climb airspeed may not exceed –
capability, be designed to prevent interruption
(i) Reserved.
of fuel flow to that engine, without attention by
the flight crew, when any tank supplying fuel to (ii) The maximum airspeed
that engine is depleted of usable fuel during established for climbing from take-off to
normal operation, and any other tank, that the maximum operating altitude.
normally supplies fuel to that engine alone,
(5) The fuel temperature must be at
contains usable fuel.
least 43.3ºC (110ºF).
(b) The test prescribed in sub-paragraph (a)
CS 25.957 Flow between interconnected of this paragraph may be performed in flight or on
tanks the ground under closely simulated flight
conditions. If a flight test is performed in weather
If fuel can be pumped from one tank to another in
cold enough to interfere with the proper conduct
flight, the fuel tank vents and the fuel transfer
of the test, the fuel tank surfaces, fuel lines, and
system must be designed so that no structural
other fuel system parts subject to cold air must be
damage to the tanks can occur because of over-
insulated to simulate, insofar as practicable, flight
filling.
in hot weather.
1–E–5
CS-25 BOOK 1
structural loads that it may be subjected to in (2) 125% of the maximum air pressure
operation. (See AMC 25.963 (a).) developed in the tank from ram effect.
(b) Flexible fuel tank liners must be approved (3) Fluid pressures developed during
or must be shown to be suitable for the particular maximum limit accelerations, and deflections,
application. of the aeroplane with a full tank.
(c) Integral fuel tanks must have facilities for (4) Fluid pressures developed during
interior inspection and repair. the most adverse combination of aeroplane roll
and fuel load.
(d) Fuel tanks must, so far as it is practicable,
be designed, located and installed so that no fuel is (b) Each metallic tank with large unsupported
released in or near the fuselage or near the engines or unstiffened flat surfaces, whose failure or
in quantities sufficient to start a serious fire in deformation could cause fuel leakage, must be
otherwise survivable crash conditions. (See also able to withstand the following test, or its
AMC 25.963(d).) equivalent, without leakage or excessive
deformation of the tank walls:
(e) Fuel tanks within the fuselage contour
must be able to resist rupture, and to retain fuel, (1) Each complete tank assembly and
under the inertia forces prescribed for the its supports must be vibration tested while
emergency landing conditions in CS 25.561. In mounted to simulate the actual installation.
addition, these tanks must be in a protected
(2) Except as specified in sub-
position so that exposure of the tanks to scraping
paragraph (b)(4) of this paragraph, the tank
action with the ground is unlikely.
assembly must be vibrated for 25 hours at an
(f) For pressurised fuel tanks, a means with amplitude of not less than 0.8 mm (1/32 of an
failsafe features must be provided to prevent the inch) (unless another amplitude is
build-up of an excessive pressure difference substantiated) while two-thirds filled with
between the inside and the outside of the tank. water or other suitable test fluid.
(g) Fuel tank access covers must comply with (3) The test frequency of vibration must
the following criteria in order to avoid loss of be as follows:
hazardous quantities of fuel:
(i) If no frequency of vibration
(1) All covers located in an area where resulting from any rpm within the normal
experience or analysis indicates a strike is operating range of engine speeds is
likely, must be shown by analysis or tests to critical, the test frequency of vibration
minimise penetration and deformation by tyre must be 2 000 cycles per minute.
fragments, low energy engine debris, or other
(ii) If only one frequency of
likely debris.
vibration resulting from any rpm within
(2) Reserved the normal operating range of engine
speeds is critical, that frequency of
(See AMC 25.963 (g).)
vibration must be the test frequency.
(iii) If more than one frequency of
CS 25.965 Fuel tank tests vibration resulting from any rpm within
the normal operating range of engine
(a) It must be shown by tests that the fuel
speeds is critical, the most critical of
tanks, as mounted in the aeroplane can withstand,
these frequencies must be the test
without failure or leakage, the more critical of the
frequency.
pressures resulting from the conditions specified
in sub-paragraphs (a)(1) and (2) of this paragraph. (4) Under sub-paragraph (b)(3) (ii) and
In addition it must be shown by either analysis or (iii) of this paragraph, the time of test must be
tests, (see AMC 25.965(a)) that tank surfaces adjusted to accomplish the same number of
subjected to more critical pressures resulting from vibration cycles that would be accomplished in
the conditions of sub-paragraphs (a)(3) and (4) of 25 hours at the frequency specified in sub-
this paragraph, are able to withstand the following paragraph (b)(3)(i) of this paragraph.
pressures:
(5) During the test, the tank assembly
(1) An internal pressure of 24 kPa (3·5 must be rocked at the rate of 16 to 20 complete
psi). cycles per minute, through an angle of 15º on
both sides of the horizontal (30º total), about
the most critical axis, for 25 hours. If motion
1–E–6
BOOK 1 CS-25
about more than one axis is likely to be critical, (e) Each fuel tank must be isolated from
the tank must be rocked about each critical axis personnel compartments by a fumeproof and
for 12·5 hours. fuelproof enclosure.
(c) Except where satisfactory operating
experience with a similar tank in a similar
installation is shown, non-metallic tanks must CS 25.969 Fuel tank expansion space
withstand the test specified in sub-paragraph
Each fuel tank must have an expansion space of
(b)(5) of this paragraph, with fuel at a temperature
not less than 2% of the tank capacity. It must be
of 43.3ºC (110ºF). During this test, a
impossible to fill the expansion space
representative specimen of the tank must be
inadvertently with the aeroplane in the normal
installed in a supporting structure simulating the
ground attitude. For pressure fuelling systems,
installation in the aeroplane.
compliance with this paragraph may be shown
(d) For pressurised fuel tanks, it must be with the means provided to comply with CS
shown by analysis or tests that the fuel tanks can 25.979(b).
withstand the maximum pressure likely to occur
on the ground or in flight.
CS 25.971 Fuel tank sump
CS 25.967 Fuel tank installations (a) Each fuel tank must have a sump with an
effective capacity, in the normal ground attitude,
(a) Each fuel tank must be supported so that
of not less than the greater of 0·10% of the tank
tank loads (resulting from the weight of the fuel in
capacity or one-quarter of a litre unless operating
the tanks) are not concentrated on unsupported
limitations are established to ensure that the
tank surfaces. In addition –
accumulation of water in service will not exceed
(1) There must be pads, if necessary, to the sump capacity.
prevent chafing between the tank and its
(b) Each fuel tank must allow drainage of any
supports;
hazardous quantity of water from any part of the
(2) Padding must be non-absorbent or tank to its sump with the aeroplane in the ground
treated to prevent the absorption of fluids; attitude.
(3) If a flexible tank liner is used, it (c) Each fuel tank sump must have an
must be supported so that it is not required to accessible drain that –
withstand fluid loads (see AMC 25.967(a)(3));
(1) Allows complete drainage of the
and
sump on the ground;
(4) Each interior surface of the tank
(2) Discharges clear of each part of the
compartment must be smooth and free of
aeroplane; and
projections that could cause wear of the liner
unless – (3) Has manual or automatic means for
positive locking in the closed position.
(i) Provisions are made for
protection of the liner at these points; or
(ii) That construction of the liner CS 25.973 Fuel tank filler connection
itself provides that protection.
Each fuel tank filler connection must prevent the
(b) Spaces adjacent to tank surfaces must be entrance of fuel into any part of the aeroplane
ventilated to avoid fume accumulation due to other than the tank itself. In addition –
minor leakage. If the tank is in a sealed
(a) Reserved
compartment, ventilation may be limited to drain
holes large enough to prevent excessive pressure (b) Each recessed filler connection that can
resulting from altitude changes. retain any appreciable quantity of fuel must have a
drain that discharges clear of each part of the
(c) The location of each tank must meet the
aeroplane;
requirements of CS 25.1185(a).
(c) Each filler cap must provide a fuel-tight
(d) No engine nacelle skin immediately
seal; and
behind a major air outlet from the engine
compartment may act as the wall of an integral
tank.
1–E–7
CS-25 BOOK 1
(d) Each fuel filling point must have a (c) The clear area of each fuel tank outlet
provision for electrically bonding the aeroplane to strainer must be at least five times the area of the
ground fuelling equipment. outlet line.
(d) The diameter of each strainer must be at
least that of the fuel tank outlet.
CS 25.975 Fuel tank vents
(e) Each finger strainer must be accessible
(a) Fuel tank vents. Each fuel tank must be
for inspection and cleaning.
vented from the top part of the expansion space so
that venting is effective under any normal flight
condition. In addition –
CS 25.979 Pressure fuelling system
(1) Each vent must be arranged to avoid
For pressure fuelling systems, the following apply:
stoppage by dirt or ice formation;
(a) Each pressure fuelling system fuel
(2) The vent arrangement must prevent
manifold connection must have means to prevent
siphoning of fuel during normal operation;
the escape of hazardous quantities of fuel from the
(3) The venting capacity and vent system if the fuel entry valve fails.
pressure levels must maintain acceptable
(b) An automatic shut-off means must be
differences of pressure between the interior and
provided to prevent the quantity of fuel in each
exterior of the tank, during –
tank from exceeding the maximum quantity
(i) Normal flight operation; approved for that tank. This means must –
(ii) Maximum rate of ascent and (1) Allow checking for proper shut-off
descent; and operation before each fuelling of the tank; and
(iii) Refuelling and defuelling (2) Provide indication, at each fuelling
(where applicable); station, of failure of the shut-off means to stop
the fuel flow at the maximum quantity
(4) Airspaces of tanks with
approved for that tank.
interconnected outlets must be interconnected;
(c) A means must be provided to prevent
(5) There may be no point in any vent
damage to the fuel system in the event of failure
line where moisture can accumulate with the
of the automatic shut-off means prescribed in sub-
aeroplane in the ground attitude or the level
paragraph (b) of this paragraph.
flight attitude, unless drainage is provided; and
(d) The aeroplane pressure fuelling system
(6) No vent or drainage provision may
(not including fuel tanks and fuel tank vents) must
end at any point –
withstand an ultimate load that is 2·0 times the
(i) Where the discharge of fuel load arising from the maximum pressures,
from the vent outlet would constitute a including surge, that is likely to occur during
fire hazard; or fuelling. The maximum surge pressure must be
established with any combination of tank valves
(ii) From which fumes could enter
being either intentionally or inadvertently closed.
personnel compartments.
(See AMC 25.979 (d).)
(e) The aeroplane defuelling system (not
including fuel tanks and fuel tank vents) must
CS 25.977 Fuel tank outlet
withstand an ultimate load that is 2·0 times the
(a) There must be a fuel strainer for the fuel load arising from the maximum permissible
tank outlet or for the booster pump. This strainer defuelling pressure (positive or negative) at the
must – aeroplane fuelling connection.
(1) Reserved.
(2) Prevent the passage of any object CS 25.981 Fuel tank temperature
that could restrict fuel flow or damage any fuel (See AMC 25.981)
system component.
(a) The highest temperature allowing a safe
(b) Reserved. margin below the lowest expected auto-ignition
temperature of the fuel in the fuel tanks must be
determined.
1–E–8
BOOK 1 CS-25
(b) No temperature at any place inside any CS 25.994 Fuel system components
fuel tank where fuel ignition is possible may (See AMC 25.994)
exceed the temperature determined under sub-
Fuel system components in an engine nacelle or in
paragraph (a) of this paragraph. This must be
the fuselage must be protected from damage which
shown under all probable operating, failure, and
could result in spillage of enough fuel to constitute
malfunction conditions of any component whose
a fire hazard as a result of a wheels-up landing on
operation, failure, or malfunction could increase
a paved runway.
the temperature inside the tank.
1–E–9
CS-25 BOOK 1
(b) Each drain required by sub-paragraph (a) (1) The fuel jettisoning system and its
of this paragraph must – operation are free from fire hazard;
(1) Discharge clear of all parts of the (2) The fuel discharges clear of any part
aeroplane; of the aeroplane;
(2) Have manual or automatic means (3) Fuel or fumes do not enter any parts
for positive locking in the closed position; and of the aeroplane;
(3) Have a drain valve – (4) The jettisoning operation does not
adversely affect the controllability of the
(i) That is readily accessible and
aeroplane.
which can be easily opened and closed;
and (e) Reserved.
(ii) That is either located or (f) Means must be provided to prevent
protected to prevent fuel spillage in the jettisoning the fuel in the tanks used for take-off
event of a landing with landing gear and landing below the level allowing climb from
retracted. sea level to 3048 m (10 000 ft) and thereafter
allowing 45 minutes cruise at a speed for
maximum range. However, if there is an auxiliary
CS 25.1001 Fuel jettisoning system control independent of the main jettisoning
control, the system may be designed to jettison the
(a) A fuel jettisoning system must be
remaining fuel by means of the auxiliary
installed on each aeroplane unless it is shown that
jettisoning control.
the aeroplane meets the climb requirements of CS
25.119 and 25.121(d) at maximum take-off (g) The fuel jettisoning valve must be
weight, less the actual or computed weight of fuel designed to allow flight personnel to close the
necessary for a 15-minute flight comprised of a valve during any part of the jettisoning operation.
take-off, go-around, and landing at the airport of
(h) Unless it is shown that using any means
departure with the aeroplane configuration, speed,
(including flaps, slots and slats) for changing the
power, and thrust the same as that used in meeting
airflow across or around the wings does not
the applicable take-off, approach, and landing
adversely affect fuel jettisoning, there must be a
climb performance requirements of this CS–25.
placard, adjacent to the jettisoning control, to
(b) If a fuel jettisoning system is required it warn flight-crew members against jettisoning fuel
must be capable of jettisoning enough fuel within while the means that change the airflow are being
15 minutes, starting with the weight given in sub- used.
paragraph (a) of this paragraph, to enable the
(i) The fuel jettisoning system must be
aeroplane to meet the climb requirements of CS
designed so that any reasonably probable single
25.119 and 25.121(d), assuming that the fuel is
malfunction in the system will not result in a
jettisoned under the conditions, except weight,
hazardous condition due to unsymmetrical
found least favourable during the flight tests
jettisoning of, or inability to jettison, fuel.
prescribed in sub-paragraph (c) of this paragraph.
(c) Fuel jettisoning must be demonstrated
beginning at maximum take-off weight with wing- OIL SYSTEM
flaps and landing gear up and in –
CS 25.1011 General
(1) A power-off glide at 1·3 VSR1;
(a) Each engine must have an independent oil
(2) A climb at the one-engine
system that can supply it with an appropriate
inoperative best rate-of-climb speed, with the
quantity of oil at a temperature not above that safe
critical engine inoperative and the remaining
for continuous operation.
engines at maximum continuous power; and
(b) The usable oil capacity may not be less
(3) Level flight at 1·3 VSR1, if the
than the product of the endurance of the aeroplane
results of the tests in the condition specified in
under critical operating conditions and the
sub-paragraphs (c)(1) and (2) of this paragraph
approved maximum allowable oil consumption of
show that this condition could be critical.
the engine under the same conditions, plus a
(d) During the flight tests prescribed in sub- suitable margin to ensure system circulation.
paragraph (c) of this paragraph, it must be shown
that –
1–E–10
BOOK 1 CS-25
1–E–11
CS-25 BOOK 1
impaired when the oil is contaminated to a flight conditions are transmitted to the lines
degree (with respect to particle size and attached to the valve.
density) that is greater than that established for
the engine under CS–E.
CS 25.1027 Propeller feathering system
(3) The oil strainer or filter, unless it is
(See AMC 25.1027.)
installed at an oil tank outlet, must incorporate
an indicator that will indicate contamination (a) If the propeller feathering system depends
before it reaches the capacity established in on engine oil, there must be means to trap an
accordance with sub-paragraph (a) (2) of this amount of oil in the tank if the supply becomes
paragraph. depleted due to failure of any part of the
lubricating system other than the tank itself.
(4) The bypass of a strainer or filter
must be constructed and installed so that the (b) The amount of trapped oil must be
release of collected contaminants is minimised enough to accomplish the feathering operation and
by appropriate location of the bypass to ensure must be available only to the feathering pump.
that collected contaminants are not in the (See AMC 25.1027 (b).)
bypass flow path.
(c) The ability of the system to accomplish
(5) An oil strainer or filter that has no feathering with the trapped oil must be shown.
bypass, except one that is installed at an oil This may be done on the ground using an auxiliary
tank outlet, must have a means to connect it to source of oil for lubricating the engine during
the warning system required in CS operation.
25.1305(c)(7).
(d) Provision must be made to prevent sludge
or other foreign matter from affecting the safe
operation of the propeller feathering system.
CS 25.1021 Oil system drains
A drain (or drains) must be provided to allow safe
COOLING
drainage of the oil system. Each drain must –
(a) Be accessible; and CS 25.1041 General
(b) Have manual or automatic means for The powerplant cooling provisions must be able to
positive locking in the closed position. maintain the temperatures of powerplant
components, and engine fluids, within the
temperature limits established for these components
CS 25.1023 Oil radiators and fluids, under ground and flight operating
conditions, and after normal engine shutdown.
(a) Each oil radiator must be able to
withstand, without failure, any vibration, inertia,
and oil pressure load to which it would be
CS 25.1043 Cooling tests
subjected in operation.
(a) General. Compliance with CS 25.1041
(b) Each oil radiator air duct must be located
must be shown by tests, under critical ground and
so that, in case of fire, flames coming from normal
flight operating conditions. For these tests, the
openings of the engine nacelle cannot impinge
following apply:
directly upon the radiator.
(1) If the tests are conducted under
conditions deviating from the maximum
CS 25.1025 Oil valves ambient atmospheric temperature, the recorded
power-plant temperatures must be corrected
(a) Each oil shut-off must meet the
under sub-paragraph (c) of this paragraph.
requirements of CS 25.1189.
(2) No corrected temperatures
(b) The closing of oil shut-off means may not
determined under sub-paragraph (1) of this
prevent propeller feathering.
paragraph may exceed established limits.
(c) Each oil valve must have positive stops or
(3) Reserved.
suitable index provisions in the ‘on’ and ‘off’
positions and must be supported so that no loads (b) Maximum ambient atmospheric
resulting from its operation or from accelerated temperature. A maximum ambient atmospheric
temperature corresponding to sea level conditions
1–E–12
BOOK 1 CS-25
1–E–13
CS-25 BOOK 1
(i) Under the icing conditions will not result in a fire caused by impingement of
specified in Appendix C. the fluids or vapours on any part of the exhaust
system including shields for the exhaust system.
(ii) Reserved
(See AMC 25.1121(b).)
(2) Each engine must idle for 30
(c) Each component that hot exhaust gases
minutes on the ground, with the air bleed
could strike, or that could be subjected to high
available for engine icing protection at its
temperatures from exhaust system parts, must be
critical condition, without adverse effect, in an
fireproof. All exhaust system components must be
atmosphere that is at a temperature between
–9º and –1ºC (15º and 30ºF) and has a liquid separated by fireproof shields from adjacent parts
water content not less than 0·3 grams per cubic of the aeroplane that are outside the engine
metre in the form of drops having a mean compartment.
effective diameter not less than 20 microns, (d) No exhaust gases may discharge so as to
followed by a momentary operation at take-off cause a fire hazard with respect to any flammable
power or thrust. During the 30 minutes of idle fluid vent or drain.
operation, the engine may be run up
periodically to a moderate power or thrust (e) No exhaust gases may discharge where
setting. they will cause a glare seriously affecting pilot
vision at night.
(f) Each exhaust system component must be
CS 25.1103 Air intake system ducts and air ventilated to prevent points of excessively high
duct systems temperature.
(a) Reserved. (g) Each exhaust shroud must be ventilated or
(b) Each air intake system must be – insulated to avoid, during normal operation, a
temperature high enough to ignite any flammable
(1) Strong enough to prevent structural fluids or vapours external to the shroud.
failure resulting from engine surging; and
(2) Fire-resistant if it is in any fire zone for
which a fire extinguishing system is required. CS 25.1123 Exhaust piping
(c) Each duct connected to components For powerplant installations, the following apply:
between which relative motion could exist must (a) Exhaust piping must be heat and
have means for flexibility. corrosion resistant, and must have provisions to
(d) For bleed air systems no hazard may prevent failure due to expansion by operating
result if a duct rupture or failure occurs at any temperatures.
point between the engine port and the aeroplane (b) Piping must be supported to withstand
unit served by the bleed air. (See AMC 25.1103 any vibration and inertia loads to which it would
(d).) be subjected in operation; and
(c) Piping connected to components between
EXHAUST SYSTEM which relative motion could exist must have
means for flexibility.
CS 25.1121 General
For powerplant installations the following apply: POWERPLANT CONTROLS AND
ACCESSORIES
(a) Each exhaust system must ensure safe
disposal of exhaust gases without fire hazard or
CS 25.1141 Powerplant controls: general
carbon monoxide contamination in any personnel
compartment. For test purposes, any acceptable Each powerplant control must be located,
carbon monoxide detection method may be used to arranged, and designed under CS 25.777 to 25.781
show the absence of carbon monoxide. (See AMC and marked under CS 25.1555. In addition, it
25.1121(a).) must meet the following requirements:
(b) Each exhaust system part with a surface (a) Each control must be located so that it
hot enough to ignite flammable fluids or vapours cannot be inadvertently operated by persons
must be located or shielded so that leakage from entering, leaving, or moving normally in, the
any system carrying flammable fluids or vapours cockpit.
1–E–14
BOOK 1 CS-25
(b) Each flexible control must be approved or (1) Have a positive lock or stop at the
must be shown to be suitable for the particular idle position; and
application.
(2) Require a separate and distinct
(c) Each control must have sufficient strength operation to place the control in the shut-off
and rigidity to withstand operating loads without position.
failure and without excessive deflection.
(d) Each control must be able to maintain any
CS 25.1145 Ignition switches
set position without constant attention by flight-
crew members and without creep due to control (a) Ignition switches must control each
loads or vibration. engine ignition circuit on each engine.
(e) The portion of each powerplant control (b) There must be means to quickly shut off
located in a designated fire zone that is required to all ignition by the grouping of switches or by a
be operated in the event of fire must be at least fire master ignition control.
resistant. (See CS 25.903(c).)
(c) Each group of ignition switches except
(f) Powerplant valve controls located in the ignition switches for turbine engines for which
cockpit must have – continuous ignition is not required, and each
master ignition control must have a means to
(1) For manual valves, positive stops or
prevent its inadvertent operation.
in the case of fuel valves suitable index
provisions, in the open and closed positions;
and
CS 25.1149 Propeller speed and pitch
(2) In the case of valves controlled
controls
from the cockpit other than by mechanical
means, where the correct functioning of such a (a) There must be a separate propeller speed
valve is essential for the safe operation of the and pitch control for each propeller.
aeroplane, a valve position indicator operated
(b) The controls must be grouped and
by a system which senses directly that the valve
arranged to allow –
has attained the position selected, unless other
indications in the cockpit give the flight crew a (1) Separate control of each propeller;
clear indication that the valve has moved to the and
selected position. (See AMC 25.1141(f).)
(2) Simultaneous control of all
propellers.
CS 25.1143 Engine controls (c) The controls must allow synchronisation
of all propellers.
(a) There must be a separate power or thrust
control for each engine. (d) The propeller speed and pitch controls
must be to the right of, and at least 25 mm (one
(b) Power and thrust controls must be
inch) below, the pilot’s throttle controls.
arranged to allow –
(1) Separate control of each engine; and
CS 25.1153 Propeller feathering controls
(2) Simultaneous control of all engines.
(a) There must be a separate propeller
(c) Each power and thrust control must
feathering control for each propeller. The control
provide a positive and immediately responsive
must have means to prevent its inadvertent
means of controlling its engine.
operation.
(d) For each fluid injection (other than fuel)
(b) If feathering is accomplished by
system and its controls not provided and approved
movement of the propeller pitch or speed control
as part of the engine, the flow of the injection
lever, there must be means to prevent the
fluid must be adequately controlled.
inadvertent movement of this lever to the
(e) If a power or thrust control incorporates a feathering position during normal operation.
fuel shut-off feature, the control must have a
means to prevent the inadvertent movement of the
control into the shut-off position. The means must
–
1–E–15
CS-25 BOOK 1
Each fuel jettisoning system control must have (e) No ground wire for any engine may be
guards to prevent inadvertent operation. No routed through a fire zone of another engine
control may be near any fire extinguisher control unless each part of that wire within that zone is
or other control used to combat fire. fireproof.
(f) Each ignition system must be independent
of any electrical circuit not used for assisting,
CS 25.1163 Powerplant accessories controlling, or analysing the operation of that
(a) Each engine-mounted accessory must – system.
(1) Be approved for mounting on the (g) There must be means to warn appropriate
engine involved; flight-crew members if the malfunctioning of any
part of the electrical system is causing the
(2) Use the provisions on the engine for continuous discharge of any battery necessary for
mounting; and engine ignition.
1–E–16
BOOK 1 CS-25
(h) Each engine ignition system of a turbine CS 25.1182 Nacelle areas behind firewalls,
powered aeroplane must be considered an and engine pod attaching
essential electrical load. structures containing
flammable fluid lines
(a) Each nacelle area immediately behind the
CS 25.1167 Accessory gearboxes
firewall, and each portion of any engine pod
For aeroplanes equipped with an accessory attaching structure containing flammable fluid
gearbox that is not certificated as part of an engine lines, must meet each requirement of CS 25.1103
– (b), 25.1165 (e), 25.1183, 25.1185 (c), 21.1187,
25.1189 and 25.1195 to 25.1203, including those
(a) The engine with gearbox and connecting
concerning designated fire zones. However,
transmissions and shafts attached must be
engine pod attaching structures need not contain
subjected to the test specified in CS–E 160 and
fire detection or extinguishing means.
CS–E 740, as applicable.
(b) For each area covered by sub-paragraph
(b) The accessory gearbox must meet the
(a) of this paragraph that contains a retractable
requirements of CS–E 80 and CS–E 590, as
landing gear, compliance with that sub-paragraph
applicable; and
need only be shown with the landing gear
(c) Possible misalignments and torsional retracted.
loadings of the gearbox, transmission, and shaft
system, expected to result under normal operating
conditions must be evaluated. CS 25.1183 Flammable fluid-carrying
components
(a) Except as provided in sub-paragraph (b)
POWERPLANT FIRE PROTECTION
of this paragraph, each line, fitting, and other
component carrying flammable fluid in any area
CS 25.1181 Designated fire zones: regions
subject to engine fire conditions, and each
included
component which conveys or contains flammable
(See AMC 25.1181.)
fluid in a designated fire zone must be fire
(a) Designated fire zones are – resistant, except that flammable fluid tanks and
supports in a designated fire zone must be
(1) The engine power section;
fireproof or be enclosed by a fireproof shield
(2) The engine accessory section; unless damage by fire to any non-fireproof part
will not cause leakage or spillage of flammable
(3) Any complete powerplant
fluid. Components must be shielded or located to
compartment in which no isolation is provided
safeguard against the ignition of leaking
between the engine power section and the
flammable fluid.
engine accessory section;
(b) Sub-paragraph (a) of this paragraph does
(4) Reserved.
not apply to –
(5) Any fuel-burning heater and other
(1) Lines, fittings and components
combustion equipment installation described in
which are already approved as part of a type
CS 25.859;
certificated engine; and
(6) The compressor and accessory
(2) Vent and drain lines, and their
sections of turbine engines; and
fittings, whose failure will not result in, or add
(7) Combustor, turbine, and tailpipe to, a fire hazard.
sections of turbine engine installations that
(c) All components, including ducts, within a
contain lines or components carrying
designated fire zone must be fireproof if, when
flammable fluids or gases.
exposed to or damaged by fire, they could –
(b) Each designated fire zone must meet the
(1) Result in fire spreading to other
requirements of CS 25.863, 25.867, 25.869, and
regions of the aeroplane, or
25.1185 to 25.1203
(2) Cause unintentional operation of, or
inability to operate, essential services or
equipment.
1–E–17
CS-25 BOOK 1
1–E–18
BOOK 1 CS-25
(3) Constructed so that each opening is critical airflow conditions in flight the discharge
sealed with close fitting fireproof grommets, of the extinguishing agent in each designated fire
bushings, or firewall fittings; and zone specified in sub-paragraph (a) of this
paragraph will provide an agent concentration
(4) Protected against corrosion.
capable of extinguishing fires in that zone and of
minimising the probability of re-ignition. An
individual ‘one-shot’ system may be used for fuel
CS 25.1193 Cowling and nacelle skin
burning heaters, and other combustion equipment.
(a) Each cowling must be constructed and For each other designated fire zone, two
supported so that it can resist any vibration, discharges must be provided each of which
inertia, and air load to which it may be subjected produces adequate agent concentration. (See
in operation. AMC 25.1195 (b).)
(b) Cowling must meet the drainage and (c) The fire-extinguishing system for a
ventilation requirements of CS 25.1187. nacelle must be able to simultaneously protect
each zone of the nacelle for which protection is
(c) On aeroplanes with a diaphragm isolating
provided.
the engine power section from the engine
accessory section, each part of the accessory
section cowling subject to flame in case of fire in
CS 25.1197 Fire-extinguishing agents
the engine power section of the powerplant must–
(a) Fire-extinguishing agents must –
(1) Be fireproof; and
(1) Be capable of extinguishing flames
(2) Meet the requirements of CS
emanating from any burning of fluids or other
25.1191.
combustible materials in the area protected by
(d) Each part of the cowling subject to high the fire extinguishing system; and
temperatures due to its nearness to exhaust system
(2) Have thermal stability over the
parts or exhaust gas impingement must be
temperature range likely to be experienced in
fireproof.
the compartment in which they are stored.
(e) Each aeroplane must –
(b) If any toxic extinguishing agent is used,
(1) Be designed and constructed so that provisions must be made to prevent harmful
no fire originating in any fire zone can enter, concentrations of fluid or fluid vapours (from
either through openings or by burning through leakage during normal operation of the aeroplane
external skin, any other zone or region where it or as a result of discharging the fire extinguisher
would create additional hazards; on the ground or in flight) from entering any
personnel compartment, even though a defect may
(2) Meet sub-paragraph (e)(1) of this
exist in the extinguishing system. This must be
paragraph with the landing gear retracted (if
shown by test except for built-in carbon dioxide
applicable); and
fuselage compartment fire extinguishing systems
(3) Have fireproof skin in areas subject for which –
to flame if a fire starts in the engine power or
(1) 2.3 kg (five pounds) or less of
accessory sections.
carbon dioxide will be discharged, under
established fire control procedures, into any
fuselage compartment; or
CS 25.1195 Fire-extinguisher systems
(2) There is protective breathing
(a) Except for combustor, turbine, and tail
equipment for each flight-crew member on
pipe sections of turbine engine installations that
flight deck duty.
contain lines or components carrying flammable
fluids or gases for which it is shown that a fire
originating in these sections can be controlled,
there must be a fire extinguisher system serving CS 25.1199 Extinguishing agent containers
each designated fire zone.
(a) Each extinguishing agent container must
(b) The fire-extinguishing system, the have a pressure relief to prevent bursting of the
quantity of the extinguishing agent, the rate of container by excessive internal pressures.
discharge, and the discharge distribution must be
(b) The discharge end of each discharge line
adequate to extinguish fires. It must be shown by
from a pressure relief connection must be located
either actual or simulated flight tests that under
1–E–19
CS-25 BOOK 1
so that discharge of the fire extinguishing agent (3) There is a means to warn the crew
would not damage the aeroplane. The line must in the event of a short circuit in the sensor or
also be located or protected to prevent clogging associated wiring within a designated fire
caused by ice or other foreign matter. zone, unless the system continues to function as
a satisfactory detection system after the short
(c) There must be a means for each fire
circuit.
extinguishing agent container to indicate that the
container has discharged or that the charging (c) No fire or overheat detector may be
pressure is below the established minimum affected by any oil, water, other fluids, or fumes
necessary for proper functioning. that might be present.
(d) The temperature of each container must (d) There must be means to allow the crew to
be maintained, under intended operating check, in flight, the functioning of each fire or
conditions, to prevent the pressure in the container overheat detector electric circuit.
from –
(e) Wiring and other components of each fire
(1) Falling below that necessary to or overheat detector system in a fire zone must be
provide an adequate rate of discharge; or at least fire-resistant.
(2) Rising high enough to cause (f) No fire or overheat detector system
premature discharge. component for any fire zone may pass through
another fire zone, unless –
(e) If a pyrotechnic capsule is used to
discharge the extinguishing agent, each container (1) It is protected against the possibility
must be installed so that temperature conditions of false warnings resulting from fires in zones
will not cause hazardous deterioration of the through which it passes; or
pyrotechnic capsule.
(2) Each zone involved is
simultaneously protected by the same detector
and extinguishing system.
CS 25.1201 Fire extinguishing system
materials (g) Each fire detector system must be
constructed so that when it is in the configuration
(a) No material in any fire extinguishing
for installation it will not exceed the alarm
system may react chemically with any
activation time approved for the detectors using
extinguishing agent so as to create a hazard.
the response time criteria specified in the
(b) Each system component in an engine appropriate European Technical Standard Order
compartment must be fireproof. for the detector.
1–E–20
BOOK 1 CS–25
SUBPART F – EQUIPMENT
1–F–1
CS–25 BOOK 1
1–F–2
BOOK 1 CS–25
1–F–3
CS–25 BOOK 1
(b) For functions whose failure would to the left of the instrument in the top centre
contribute to or cause a condition that would reduce position;
the capability of the aeroplane or the ability of the
(3) The instrument that most effectively
flight crew to cope with adverse operating
indicates altitude must be adjacent to and directly
conditions, each electrical and electronic system that
to the right of the instrument in the top centre
performs these functions must be designed and
position; and
installed to ensure that these functions can be
recovered in a timely manner after the aeroplane is (4) The instrument that most effectively
exposed to lightning. indicates direction of flight must be adjacent to
and directly below the instrument in the top centre
(c) Compliance with the lightning protection
position.
criteria prescribed in sub-paragraphs (a) and (b) of
this paragraph must be shown for exposure to a (c) Required powerplant instruments must be
severe lightning environment. The aeroplane must be closely grouped on the instrument panel. In addition
designed for and it must be verified that aircraft –
electrical/electronic systems are protected against the
(1) The location of identical powerplant
effects of lightning by:
instruments for the engines must prevent
(1) Determining the lightning strike zones confusion as to which engine each instrument
for the aeroplane; relates; and
(2) Establishing the external lightning (2) Powerplant instruments vital to the
environment for the zones; safe operation of the aeroplane must be plainly
visible to the appropriate crewmembers.
(3) Establishing the internal environment;
(d) Instrument panel vibration may not damage
(4) Identifying all the electrical and
or impair the accuracy of any instrument.
electronic systems that are subject to the
requirements of this paragraph, and their locations (e) If a visual indicator is provided to indicate
on or within the aeroplane; malfunction of an instrument, it must be effective
under all probable cockpit lighting conditions.
(5) Establishing the susceptibility of the
systems to the internal and external lightning
environment;
CS 25.1322 Warning, caution, and
(6) Designing protection; and advisory lights
(See AMC 25.1322)
(7) Verifying that the protection is
adequate. If warning, caution, or advisory lights are installed in
the cockpit, they must, unless otherwise approved by
the Agency, be –
(a) Red, for warning lights (lights indicating a
INSTRUMENTS: INSTALLATION
hazard, which may require immediate corrective
action);
CS 25.1321 Arrangement and visibility
(b) Amber, for caution lights (lights indicating
(a) Each flight, navigation, and powerplant
the possible need for future corrective action);
instrument for use by any pilot must be plainly
visible to him from his station with the minimum (c) Green, for safe operation lights; and
practicable deviation from his normal position and
(d) Any other colour, including white, for lights
line of vision when he is looking forward along the
not described in sub-paragraphs (a) to (c) of this
flight path.
paragraph, provided the colour differs sufficiently
(b) The flight instruments required by CS from the colours prescribed in sub-paragraphs (a) to
25.1303 must be grouped on the instrument panel and (c) of this paragraph to avoid possible confusion.
centred as nearly as practicable about the vertical
plane of the pilot’s forward vision. In addition –
CS 25.1323 Airspeed indicating system
(1) The instrument that most effectively
indicates attitude must be on the panel in the top For each airspeed indicating system, the
centre position; following apply:
(2) The instrument that most effectively (a) Each airspeed indicating instrument must be
indicates airspeed must be adjacent to and directly approved and must be calibrated to indicate true
1–F–4
BOOK 1 CS–25
airspeed (at sea-level with a standard atmosphere) due to icing. (See AMC to 25.1323 (i) and
with a minimum practicable instrument calibration 25.1325(b).)
error when the corresponding pitot and static
(j) Where duplicate airspeed indicators are
pressures are applied.
required, their respective pitot tubes must be far
(b) Each system must be calibrated to determine enough apart to avoid damage to both tubes in a
the system error (that is, the relation between IAS collision with a bird.
and CAS) in flight and during the accelerated take-
off ground run. The ground run calibration must be
determined – CS 25.1325 Static pressure systems
(1) From 0·8 of the minimum value of V1, (a) Each instrument with static air case
to the maximum value of V2, considering the connections must be vented to the outside
approved ranges of altitude and weight; and atmosphere through an appropriate piping system.
(2) With the wing-flaps and power (b) Each static port must be designed and
settings corresponding to the values determined located in such manner that static pressure system
in the establishment of the take-off path under CS performance is least affected by airflow variation, or
25.111 assuming that the critical engine fails at by moisture or other foreign matter, and that the
the minimum value of V1. correlation between air pressure in the static pressure
system and true ambient atmospheric static pressure
(c) The airspeed error of the installation, is not changed when the aeroplane is exposed to the
excluding the airspeed indicator instrument continuous and intermittent maximum icing
calibration error, may not exceed 3% or five knots, conditions defined in Appendix C. (See AMC to
whichever is greater, throughout the speed range, 25.1323 (i) and 25.1325(b).)
from –
(c) The design and installation of the static
(1) VMO to 1·23 VSR1 with wing-flaps pressure system must be such that –
retracted; and
(1) Positive drainage of moisture is
(2) 1·23 VSR0 to VFE with wing-flaps in the provided; chafing of the tubing and excessive
landing position. distortion or restriction at bends in the tubing is
(d) From 1·23 VSR to the speed at which stall avoided; and the materials used are durable,
warning begins, the IAS must change perceptibly suitable for the purpose intended, and protected
with CAS and in the same sense, and at speeds below against corrosion; and
stall warning speed the IAS must not change in an
(2) It is airtight except for the port into
incorrect sense. (See AMC 25.1323 (d).)
the atmosphere. A proof test must be conducted
(e) From VMO to VMO + 2 (VDF – VMO) the IAS to demonstrate the integrity of the static pressure
3
must change perceptibly with CAS and in the same system in the following manner:
sense, and at higher speeds up to VDF the IAS must (i) Unpressurised aeroplanes.
not change in an incorrect sense. (See AMC 25.1323 Evacuate the static pressure system to a
(e)) pressure differential of approximately 33.86
(f) There must be no indication of air-speed HPa, (1 inch of mercury) or to a reading on
that would cause undue difficulty to the pilot during the altimeter, 305 m (1 000 ft) above the
the take-off between the initiation of rotation and the aeroplane elevation at the time of the test.
achievement of a steady climbing condition. Without additional pumping for a period of
1 minute, the loss of indicated altitude must
(g) The effects of airspeed indicating system not exceed 30 m (100 ft) on the altimeter.
lag may not introduce significant takeoff indicated (ii) Pressurised aeroplanes.
airspeed bias, or significant errors in takeoff or Evacuate the static pressure system until
accelerate-stop distances. pressure differential equivalent to the
(h) Each system must be arranged, so far as maximum cabin pressure differential for
practicable, to prevent malfunction or serious error which the aeroplane is type certificated is
due to the entry of moisture, dirt, or other substances. achieved. Without additional pumping for a
(See AMC 25.1323 (h).) period of 1 minute, the loss of indicated
altitude must not exceed 2% of the
(i) Each system must have a heated pitot tube equivalent altitude of the maximum cabin
or an equivalent means of preventing malfunction differential pressure or 30 m (100 ft),
whichever is greater.
1–F–5
CS–25 BOOK 1
(d) Each pressure altimeter must be approved (1) The pitot heating system is switched
and must be calibrated to indicate pressure altitude in ‘off’.
a standard atmosphere, with a minimum practicable
(2) The pitot heating system is switched
calibration error when the corresponding static
‘on’ and any pitot tube heating element is
pressures are applied.
inoperative.
(e) Each system must be designed and installed so
that the error in indicated pressure altitude, at sea-level,
with a standard atmosphere, excluding instrument CS 25.1327 Direction Indicator
calibration error, does not result in an error of more (See AMC 25.1327)
than ±9 m (±30 ft) per 185 km/hr (100 knots) speed for
the appropriate configuration in the speed range (a) Each magnetic direction indicator must be
between 1·23 VSR0 with wing-flaps extended and installed so that its accuracy is not excessively
1·7 VSR1 with wing-flaps retracted. However, the error affected by the aeroplane’s vibration or magnetic
need not be less than ±9 m (±30 ft). fields.
(b) The magnetic direction indicator required
(f) If an altimeter system is fitted with a device
by CS 25.1303(a)(3) may not have a deviation, after
that provides corrections to the altimeter indication,
compensation, in normal level flight, greater than 10
the device must be designed and installed in such
degrees on any heading.
manner that it can be bypassed when it malfunctions,
(c) Direction indicators required by CS
unless an alternate altimeter system is provided.
25.1303(b)(6) must have an accuracy adequate for
Each correction device must be fitted with a means
the safe operation of the aeroplane.
for indicating the occurrence of reasonably probable
malfunctions, including power failure, to the flight
crew. The indicating means must be effective for
CS 25.1329 Automatic pilot system
any cockpit lighting condition likely to occur.
(See AMC 25.1329.)
(g) Except as provided in sub-paragraph (h) of
(a) Each automatic pilot system must be
this paragraph, if the static pressure system
approved and must be designed so that the automatic
incorporates both a primary and an alternate static
pilot can be quickly and positively disengaged by the
pressure source, the means for selecting one or the
pilots to prevent it from interfering with their control
other source must be designed so that –
of the aeroplane.
(1) When either source is selected, the
other is blocked off; and (b) Unless there is automatic synchronisation,
each system must have a means to readily indicate to
(2) Both sources cannot be blocked off
the pilot the alignment of the actuating device in
simultaneously.
relation to the control system it operates.
(h) For un-pressurised aeroplanes, sub-
(c) Each manually operated control for the
paragraph (g)(1) of this paragraph does not apply if it
system must be readily accessible to the pilots.
can be demonstrated that the static pressure system
calibration, when either static pressure source is (d) Quick release (emergency) controls must be
selected, is not changed by the other static pressure on both control wheels, on the side of each wheel
source being open or blocked. opposite the throttles.
(e) Attitude controls must operate in the plane
and sense of motion specified in CS 25.777 (b) and
CS 25.1326 Pitot heat indication
25.779 (a) for cockpit controls. The direction of
systems
motion must be plainly indicated on, or adjacent to,
If a flight instrument pitot heating system is installed, each control.
an indication system must be provided to indicate to
(f) The system must be designed and adjusted
the flight crew when that pitot heating system is not
so that, within the range of adjustment available to
operating. The indication system must comply with
the human pilot, it cannot produce hazardous loads
the following requirements:
on the aeroplane, or create hazardous deviations in
(a) The indication provided must incorporate an the flight path, under any condition of flight
amber light that is in clear view of a flight-crew appropriate to its use, either during normal operation,
member. or in the event of a malfunction, assuming that
corrective action begins within a reasonable period of
(b) The indication provided must be designed to
time.
alert the flight crew if either of the following
conditions exist:
1–F–6
BOOK 1 CS–25
(g) If the automatic pilot integrates signals from CS 25.1333 Instrument systems
auxiliary controls or furnishes signals for operation
(a) For systems that operate the instruments
of other equipment, there must be positive interlocks
required by CS 25.1303 (b), which are located at
and sequencing of engagement to prevent improper
each pilot’s station, means must be provided to
operation. Protection against adverse interaction of
connect the required instruments at the first pilot’s
integrated components, resulting from a malfunction,
station to operating systems, which are independent
is also required.
of the operating systems at other flight crew stations,
(h) Means must be provided to indicate to the or other equipment.
flight crew the current mode of operation and any
(b) Equipment, systems, and installations must
modes armed by the pilot. Selector switch position is
be designed so that sufficient information is available
not acceptable as a means of indication.
to assure control of the aeroplane in airspeed,
(i) A warning must be provided to each pilot in altitude, direction and attitude by one of the pilots
the event of automatic or manual disengagement of without additional flight crew action after any single
the automatic pilot. (See CS 25.1322 and AMC failure or combination of failures that is not assessed
25.1322.) to be extremely improbable (see AMC 25.1333 (b));
and
(c) Additional instruments, systems, or
CS 25.1331 Instruments using a power
equipment may not be connected to the operating
supply
systems for the instruments required by CS 25.1303
(a) For each instrument required by CS 25.1303 (b), unless provisions are made to ensure the
(b) that uses a power supply, the following apply: continued normal functioning of the required
(1) Each instrument must have a visual instruments in the event of any malfunction of the
means integral with the instrument, to indicate additional instruments, systems, or equipment which
when power adequate to sustain proper instrument is not shown to be extremely improbable.
performance is not being supplied. The power
must be measured at or near the point where it
enters the instruments. For electric instruments, CS 25.1335 Flight director systems
the power is considered to be adequate when the
Means must be provided to indicate to the flight crew
voltage is within approved limits.
the current mode of operation and any modes armed
(2) Each instrument must, in the event of by the pilot. Selector switch position is not
the failure of one power source, be supplied by acceptable as a means of indication.
another power source. This may be accomplished
automatically or by manual means. The failure of
one power source must not affect the same CS 25.1337 Powerplant instruments
instrument of both pilot stations.
(a) Instruments and instrument lines
(3) If an instrument presenting flight
(1) Each powerplant instrument line must
and/or navigation data receives information from
meet the requirements of CS 25.993 and CS
sources external to that instrument and loss of that
25.1183.
information would render the presented data
unreliable, a clear and unambiguous visual (2) Each line carrying flammable fluids
warning must be given to the crew when such loss under pressure must –
of information occurs that the presented data
(i) Have restricting orifices or
should not be relied upon. The indication must be
other safety devices at the source of
incorporated in the instrument.
pressure to prevent the escape of excessive
(b) As used in this paragraph, ‘instrument’ fluid if the line fails; and
includes devices that are physically contained in one
(ii) Be installed and located so that
unit, and devices that are composed of two or more
the escape of fluids would not create a
physically separate units or components connected
hazard.
together (such as a remote indicating gyroscopic
direction indicator that includes a magnetic sensing (3) Each powerplant instrument that
element, a gyroscopic unit, an amplifier, and an utilises flammable fluids must be installed and
indicator connected together). located so that the escape of fluid would not
create a hazard.
(b) Fuel quantity indicator. There must be
means to indicate to the flight-crew members, the
1–F–7
CS–25 BOOK 1
quantity, in litres, (gallons), or equivalent units, of (3) The system voltage and frequency (as
usable fuel in each tank during flight. In addition – applicable) at the terminals of all essential load
equipment can be maintained within the limits for
(1) Each fuel quantity indicator must be
which the equipment is designed, during any
calibrated to read ‘zero’ during level flight when
probable operating condition;
the quantity of fuel remaining in the tank is equal
to the unusable fuel supply determined under CS (4) System transients due to switching,
25.959; fault clearing, or other causes do not make
essential loads inoperative, and do not cause a
(2) Tanks with interconnected outlets and
smoke or fire hazard;
airspaces may be treated as one tank and need not
have separate indicators; and (5) There are means accessible where
necessary, in flight, to appropriate crew members
(3) Each exposed sight gauge, used as a
for the individual and rapid disconnection of each
fuel quantity indicator, must be protected against
electrical power source (see AMC
damage.
25.1351(b)(5)); and
(c) Fuel flow meter system. If a fuel flow
(6) There are means to indicate to
meter system is installed, each metering component
appropriate crew members the generating system
must have a means for bypassing the fuel supply if
quantities essential for the safe operation of the
malfunction of that component severely restricts fuel
system, such as the voltage and current supplied
flow.
by each generator (see AMC 25.1351(b)(6)).
(d) Oil quantity indicator. There must be a
stick gauge or equivalent means to indicate the (c) External power. If provisions are made for
quantity of oil in each tank. If an oil transfer or connecting external power to the aeroplane, and that
reserve oil supply system is installed, there must be a external power can be electrically connected to
means to indicate to the flight crew, in flight, the equipment other than that used for engine starting,
quantity of oil in each tank. means must be provided to ensure that no external
power supply having a reverse polarity, a reverse
(e) Turbo-propeller blade position indicator.
phase sequence (including crossed phase and
Required turbo-propeller blade position indicators
neutral), open circuit line, incorrect frequency or
must begin indicating before the blade moves more
voltage, can supply power to the aeroplane’s
than 8º below the flight low pitch stop. The source
electrical system.
of indication must directly sense the blade position.
(d) Operation without normal electrical power.
(See AMC 25.1351 (d).) The following apply:
(1) Unless it can be shown that the loss of
ELECTRICAL SYSTEMS AND EQUIPMENT
the normal electrical power generating system(s)
is Extremely Improbable, alternate high integrity
CS 25.1351 General
electrical power system(s), independent of the
(a) Electrical system capacity. The required normal electrical power generating system(s),
generating capacity, and number and kinds of power must be provided to power those services
sources must – necessary to complete a flight and make a safe
landing.
(1) Be determined by an electrical load
analysis; and (2) The services to be powered must
include –
(2) Meet the requirements of CS 25.1309.
(i) Those required for immediate
(b) Generating system. The generating system
safety and which must continue to operate
includes electrical power sources, main power
following the loss of the normal electrical
busses, transmission cables, and associated control,
power generating system(s), without the
regulation, and protective devices. It must be
need for flight crew action;
designed so that –
(ii) Those required for continued
(1) Power sources function properly when
controlled flight; and
independent and when connected in combination;
(iii) Those required for descent,
(2) No failure or malfunction of any
approach and landing.
power source can create a hazard or impair the
ability of remaining sources to supply essential (3) Failures, including junction box,
loads; control panel or wire bundle fires, which would
result in the loss of the normal and alternate
1–F–8
BOOK 1 CS–25
1–F–9
CS–25 BOOK 1
1–F–10
BOOK 1 CS–25
spillage, where such damage or contamination may CS 25.1385 Position light system
hazard the aeroplane. installation
(a) General. Each part of each position light
(d) Unless it can be shown that compliance with
system must meet the applicable requirements of this
CS 25.1309(b) is provided by the circuit protective
paragraph and each system as a whole must meet the
device required by CS 25.1357(a), electric motors
requirements of CS 25.1387 to 25.1397.
and transformers etc. (including those installed in
domestic systems, such as galleys and toilet flush (b) Forward position lights. Forward position
systems) must be provided with a suitable thermal lights must consist of a red and a green light spaced
protection device if necessary to prevent them laterally as far apart as practicable and installed
overheating such as to create a smoke or fire hazard forward on the aeroplane so that, with the aeroplane
under normal operation and failure conditions. in the normal flying position, the red light is on the
left side, and the green light is on the right side.
Each light must be approved.
LIGHTS
(c) Rear position light. The rear position light
CS 25.1381 Instrument lights must be a white light mounted as far aft as
practicable on the tail or on each wing tip, and must
(a) The instrument lights must –
be approved.
(1) Provide sufficient illumination to
(d) Light covers and colour filters. Each light
make each instrument, switch and other device
cover or colour filter must be at least flame resistant
necessary for safe operation easily readable unless
and may not change colour or shape or lose any
sufficient illumination is available from another
appreciable light transmission during normal use.
source; and
(2) Be installed so that –
CS 25.1387 Position light system
(i) Their direct rays are shielded
dihedral angles
from the pilot’s eyes; and
(a) Except as provided in sub-paragraph (e) of
(ii) No objectionable reflections are
this paragraph, each forward and rear position light
visible to the pilot.
must, as installed, show unbroken light within the
(b) Unless undimmed instrument lights are dihedral angles described in this paragraph.
satisfactory under each expected flight condition,
(b) Dihedral angle L (left) is formed by two
there must be a means to control the intensity of
intersecting vertical planes, the first parallel to the
illumination.
longitudinal axis of the aeroplane, and the other at
110º to the left of the first, as viewed when looking
forward along the longitudinal axis.
CS 25.1383 Landing lights
(c) Dihedral angle R (right) is formed by two
(a) Each landing light must be approved, and
intersecting vertical planes, the first parallel to the
must be installed so that –
longitudinal axis of the aeroplane, and the other at
(1) No objectionable glare is visible to 110º to the right of the first, as viewed when looking
the pilot; forward along the longitudinal axis.
(2) The pilot is not adversely affected by (d) Dihedral angle A (aft) is formed by two
halation; and intersecting vertical planes making angles of 70º to
the right and to the left, respectively, to a vertical
(3) It provides enough light for night
plane passing through the longitudinal axis, as
landing.
viewed when looking aft along the longitudinal axis.
(b) Except when one switch is used for the
(e) If the rear position light when mounted as
lights of a multiple light installation at one location,
far aft as practicable in accordance with CS 25.1385
there must be a separate switch for each light.
(c), cannot show unbroken light within dihedral
(c) There must be a means to indicate to the angle A (as defined in sub-paragraph (d) of this
pilots when the landing lights are extended. paragraph), a solid angle or angles of obstructed
visibility totalling not more than 0·04 steradians is
allowable within that dihedral angle, if such solid
angle is within a cone whose apex is at the rear
position light and whose elements make an angle of
1–F–11
CS–25 BOOK 1
30º with a vertical line passing through the rear CS 25.1391 Minimum intensities in the
position light. horizontal plane of forward
and rear position lights
Each position light intensity must equal or exceed the
CS 25.1389 Position light distribution
applicable values in the following table:
and intensities
(a) General. The intensities prescribed in this Angle from
paragraph must be provided by new equipment with right or left of
light covers and colour filters in place. Intensities Dihedral angle longitudinal Intensity
must be determined with the light source operating at (light included) axis, measured candela
a steady value equal to the average luminous output from dead (candles)
of the source at the normal operating voltage of the ahead
aeroplane. The light distribution and intensity of L and R 0º to 10º 41 (40)
each position light must meet the requirements of (forward
sub-paragraph (b) of this paragraph. red and green) 10º to 20º 31 (30)
(b) Forward and rear position lights. The light 20º to 110º 5
distribution and intensities of forward and rear A (rear white) 110º to 180º 20
position lights must be expressed in terms of
minimum intensities in the horizontal plane,
minimum intensities in any vertical plane, and CS 25.1393 Minimum intensities in any
maximum intensities in overlapping beams, within vertical plane of forward
dihedral angles L, R and A, and must meet the and rear position lights
following requirements:
Each position light intensity must equal or exceed the
(1) Intensities in the horizontal plane. applicable values in the following table:
Each intensity in the horizontal plane (the plane
containing the longitudinal axis of the aeroplane Angle above or below Intensity
and perpendicular to the plane of symmetry of the the horizontal plane:
aeroplane) must equal or exceed the values in CS 0º 1·00 I
25.1391. 0º to 5º 0·90 I
(2) Intensities in any vertical plane. Each 5º to 10º 0·80 I
intensity in any vertical plane (the plane 10º to 15º 0·70 I
perpendicular to the horizontal plane) must equal 15º to 20º 0·50 I
or exceed the appropriate value in CS 25.1393, 20º to 30º 0·30 I
where I is the minimum intensity prescribed in CS 30º to 40º 0·10 I
25.1391 for the corresponding angles in the 40º to 90º 0·05 I
horizontal plane.
(3) Intensities in overlaps between
CS 25.1395 Maximum intensities in
adjacent signals. No intensity in any overlap
over-lapping beams of
between adjacent signals may exceed the values
forward and rear position
given in CS 25.1395, except that higher intensities
lights
in overlaps may be used with main beam
intensities substantially greater than the minima No position light intensity may exceed the applicable
specified in CS 25.1391 and 25.1393 if the values in the following table, except as provided in
overlap intensities in relation to the main beam CS 25.1389 (b)(3):
intensities do not adversely affect signal clarity.
When the peak intensity of the forward position
lights is more than 102 cd (100 candles), the
maximum overlap intensities between them may
exceed the values given in CS 25.1395 if the
overlap intensity in Area A is not more than 10%
of peak position light intensity and the overlap
intensity in Area B is not greater than 2·5% of
peak position light intensity.
1–F–12
BOOK 1 CS–25
CS 25.1401 Anti-collision light system (f) Minimum effective intensities for anti-
collision lights. Each anti-collision light effective
(a) General. The aeroplane must have an anti- intensity must equal or exceed the applicable values
collision light system that – in the following table:
(1) Consists of one or more approved
anti-collision lights located so that their light will
not impair the crew’s vision or detract from the
conspicuity of the position lights; and
1–F–13
CS–25 BOOK 1
(2) Protect the safety equipment from (b) Each liferaft and each life preserver must be
inadvertent damage. approved. In addition –
(c) Emergency exit descent device. The (1) Unless excess rafts of enough
stowage provisions for the emergency exit descent capacity are provided, the buoyancy and seating
device required by CS 25.809 (f) must be at the exits capacity beyond the rated capacity of the rafts
for which they are intended. must accommodate all occupants of the aeroplane
in the event of a loss of one raft of the largest
(d) Liferafts rated capacity; and
(1) The stowage provisions for the (2) Each raft must have a trailing line,
liferafts described in CS 25.1415 must and must have a static line designed to hold the
accommodate enough rafts for the maximum raft near the aeroplane but to release it if the
number of occupants for which certification for aeroplane becomes totally submerged.
ditching is requested.
(c) Approved survival equipment must be
(2) Life rafts must be stowed near exits attached to, or stored adjacent to, each liferaft.
through which the rafts can be launched during an
unplanned ditching. (d) There must be an approved survival type
emergency locator transmitter for use in one life raft.
(3) Rafts automatically or remotely
released outside the aeroplane must be attached to (e) For aeroplanes, not certificated for ditching
the aeroplane by means of the static line under CS 25.801 and not having approved life
prescribed in CS 25.1415. preservers, there must be an approved flotation
means for each occupant. This means must be within
1–F–14
BOOK 1 CS–25
easy reach of each seated occupant and must be A public address system required by this CS must –
readily removable from the aeroplane.
(a) Be powerable when the aircraft is in flight
or stopped on the ground, after the shutdown or
failure of all engines and auxiliary power units, or
CS 25.1419 Ice Protection
the disconnection or failure of all power sources
(See AMC 25.1419)
dependent on their continued operation, for –
If certification for flight in icing conditions is
(1) A time duration of at least 10 minutes,
desired, the aeroplane must be able to safely operate
including an aggregate time duration of at least 5
in the continuous maximum and intermittent
minutes of announcements made by flight and
maximum icing conditions of Appendix C. To
cabin crew members, considering all other loads
establish that the aeroplane can operate within the
which may remain powered by the same source
continuous maximum and intermittent maximum
when all other power sources are inoperative; and
conditions of Appendix C–
(2) An additional time duration in its
(a) An analysis must be performed to establish
standby state appropriate or required for any other
that the ice protection for the various components of
loads that are powered by the same source and
the aeroplane is adequate, taking into account the
that are essential to safety of flight or required
various aeroplane operational configurations; and
during emergency conditions.
(b) To verify the ice protection analysis, to
(b) The system must be capable of operation
check for icing anomalies, and to demonstrate that
within 3 seconds from the time a microphone is
the ice protection system and its components are
removed from its stowage by a cabin crew member at
effective, the aeroplane or its components must be
those stations in the passenger compartment from
flight tested in the various operational
which its use is accessible.
configurations, in measured natural atmospheric
icing conditions, and as found necessary, by one or (c) Be intelligible at all passenger seats,
more of the following means: lavatories, and cabin crew member seats and work
stations.
(1) Laboratory dry air or simulated icing
tests, or a combination of both, of the components (d) Be designed so that no unused, un-stowed
or models of the components. microphone will render the system inoperative.
(2) Flight dry air tests of the ice (e) Be capable of functioning independently of
protection system as a whole, or of its individual any required crewmember interphone system.
components.
(f) Be accessible for immediate use from each
(3) Flight tests of the aeroplane or its of two flight-crew member stations in the pilot
components in measured simulated icing compartment.
conditions.
(g) For each required floor-level passenger
(c) Caution information, such as an amber emergency exit which has an adjacent cabin crew
caution light or equivalent, must be provided to alert member seat, have a microphone which is readily
the flight crew when the anti-ice or de-ice system is accessible to the seated cabin crew member, except
not functioning normally. that one microphone may serve more than one exit,
provided the proximity of the exits allows unassisted
(d) For turbine engine powered aeroplanes, the
verbal communications between seated cabin crew
ice protection provisions of this paragraph are
members.
considered to be applicable primarily to the airframe.
For the powerplant installation, certain additional
MISCELLANEOUS EQUIPMENT
provisions of Subpart E may be found applicable.
CS 25.1431 Electronic equipment
CS 25.1421 Megaphones (a) In showing compliance with CS 25.1309 (a)
and (b) with respect to radio and electronic
If a megaphone is installed, a restraining means must
equipment and their installations, critical
be provided that is capable of restraining the
environmental conditions must be considered
megaphone when it is subjected to the ultimate
inertia forces specified in CS 25.561 (b)(3). (b) Radio and electronic equipment must be
supplied with power under the requirements of CS
25.1355 (c).
CS 25.1423 Public address system
1–F–15
CS–25 BOOK 1
(c) Radio and electronic equipment, controls combination with ultimate structural loads that
and wiring must be installed so that operation of any can reasonably occur simultaneously;
one unit or system of units will not adversely affect
(4) Withstand the fatigue effects of all
the simultaneous operation of any other radio or
cyclic pressures, including transients, and
electronic unit, or system of units, required by this
associated externally induced loads, taking into
CS–25.
account the consequences of element failure; and
(d) Electronic equipment must be designed and
(5) Perform as intended under all
installed such that it does not cause essential loads to
environmental conditions for which the aeroplane
become inoperative, as a result of electrical power
is certificated.
supply transients or transients from other causes.
(b) System design. Each hydraulic system must:
(1) Have means located at a flight crew
CS 25.1433 Vacuum systems
member station to indicate appropriate system
There must be means, in addition to the normal parameters, if
pressure relief, to automatically relieve the pressure in
(i) It performs a function necessary
the discharge lines from the vacuum air pump when
for continued safe flight and landing; or
the delivery temperature of the air becomes unsafe.
(ii) In the event of hydraulic system
malfunction, corrective action by the crew
CS 25.1435 Hydraulic Systems to ensure continued safe flight and landing
(See AMC 25.1435) is necessary;
(2) Have means to ensure that system
(a) Element design. Each element of the
pressures, including transient pressures and
hydraulic system must be designed to:
pressures from fluid volumetric changes in
(1) Withstand the proof pressure without elements that are likely to remain closed long
permanent deformation that would prevent it from enough for such changes to occur, are within the
performing its intended function, and the ultimate design capabilities of each element, such that
pressure without rupture. The proof and ultimate they meet the requirements defined in JAR
pressures are defined in terms of the design 25.1435(a)(1) through CS 25.1435(a)(5)
operating pressure (DOP) as follows: inclusive;
(3) Have means to minimise the release of
harmful or hazardous concentrations of hydraulic
Element Proof Ultimate
fluid or vapours into the crew and passenger
(x DOP) (x DOP) compartments during flight;
1. Tubes and fittings 1.5 3.0 (4) Meet the applicable requirements of
CS 25.863, 25.1183, 25.1185 and 25.1189 if a
2. Pressure vessels flammable hydraulic fluid is used; and
containing gas
(5) Be designed to use any suitable
High pressure (e.g. 3.0 4.0 hydraulic fluid specified by the aeroplane
accumulators) manufacturer, which must be identified by
Low pressure (e.g. 1.5 3.0 appropriate markings as required by CS 25.1541.
reservoirs) (c) Tests. Tests must be conducted on the
3. Hoses 2.0 4.0 hydraulic system(s), and/or subsystem(s) and
element(s), except that analysis may be used in place
4. All other elements 1.5 2.0 of or to supplement testing where the analysis is
shown to be reliable and appropriate. All internal
and external influences must be taken into account to
(2) Withstand, without deformation that an extent necessary to evaluate their effects, and to
would prevent it from performing its intended assure reliable system and element functioning and
function, the design operating pressure in integration. Failure or unacceptable deficiency of an
combination with limit structural loads that may element or system must be corrected and be
be imposed; sufficiently retested, where necessary.
(3) Withstand, without rupture, the design (1) The system(s), subsystem(s), or
operating pressure multiplied by a factor of 1.5 in element(s) must be subjected to performance,
1–F–16
BOOK 1 CS–25
fatigue, and endurance tests representative of limit pressure loads multiplied by a factor of 1·5
aeroplane ground and flight operations. in combination with ultimate structural loads that
can reasonably occur simultaneously.
(2) The complete system must be tested to
determine proper functional performance and (i) Pw . The working pressure is
relation to other systems, including simulation of the maximum steady pressure in service
relevant failure conditions, and to support or acting on the element including the
validate element design. tolerances and possible pressure variations
in normal operating modes but excluding
(3) The complete hydraulic system(s) must
transient pressures.
be functionally tested on the aeroplane in normal
operation over the range of motion of all (ii) PL. The limit pressure is the
associated user systems. The test must be anticipated maximum pressure in service
conducted at the relief pressure or 1.25 times the acting on a pressure vessel, including the
DOP if a system pressure relief device is not part tolerances and possible pressure variations
of the system design. Clearances between in normal operating modes but excluding
hydraulic system elements and other systems or transient pressures.
structural elements must remain adequate and
(2) A means to indicate system pressure
there must be no detrimental effects.
located at a flight-crew member station, must be
provided for each pneumatic system that –
CS 25.1436 Pneumatic systems – high (i) Performs a function that is
pressure essential for continued safe flight and
landing; or
(a) General. Pneumatic systems which are
powered by, and/or used for distributing or storing, (ii) In the event of pneumatic
air or nitrogen, must comply with the requirements of system malfunction, requires corrective
this paragraph. action by the crew to ensure continued safe
flight and landing.
(1) Compliance with CS 25.1309 for
pneumatic systems must be shown by functional (3) There must be means to ensure that
tests, endurance tests and analysis. Any part of a system pressures, including transient pressures
pneumatic system which is an engine accessory and pressures from gas volumetric changes in
must comply with the relevant requirements of CS components which are likely to remain closed
25.1163. long enough for such changes to occur –
(2) No element of the pneumatic system (i) Will be within 90 to 110% of
which would be liable to cause hazardous effects pump average discharge pressure at each
by exploding, if subject to a fire, may be mounted pump outlet or at the outlet of the pump
within an engine bay or other designated fire transient pressure dampening device, if
zone, or in the same compartment as a combustion provided; and
heater.
(ii) Except as provided in sub-
(3) When the system is operating no paragraph (b)(6) of this paragraph, will not
hazardous blockage due to freezing must occur. If exceed 125% of the design operating
such blockage is liable to occur when the pressure, excluding pressure at the outlets
aeroplane is stationary on the ground, a pressure specified in sub-paragraph (b)(3)(i) of this
relieving device must be installed adjacent to each paragraph. Design operating pressure is the
pressure source. maximum steady operating pressure.
(b) Design. Each pneumatic system must be The means used must be effective in
designed as follows: preventing excessive pressures being
generated during ground charging of the
(1) Each element of the pneumatic system
system. (See AMC 25.1436 (b)(3).)
must be designed to withstand the loads due to the
working pressure, Pw, in the case of elements (4) Each pneumatic element must be
other than pressure vessels or to the limit installed and supported to prevent excessive
pressure, PL, in the case of pressure vessels, in vibration, abrasion, corrosion, and mechanical
combination with limit structural loads which may damage, and to withstand inertia loads.
be imposed without deformation that would
(5) Means for providing flexibility must
prevent it from performing its intended function,
be used to connect points in a pneumatic line
and to withstand without rupture, the working or
1–F–17
CS–25 BOOK 1
between which relative motion or differential to occur in service. Elements which fail during
vibration exists. the tests must be modified in order to have the
design deficiency corrected and, where necessary,
(6) Transient pressure in a part of the
must be sufficiently retested. Simulation of
system may exceed the limit specified in sub-
operating and environmental conditions must be
paragraph (b)(3)(ii) of this paragraph if –
completed on elements and appropriate portions of
(i) A survey of those transient the pneumatic system to the extent necessary to
pressures is conducted to determine their evaluate the environmental effects. (See AMC
magnitude and frequency; and 25.1436 (c)(2).)
(ii) Based on the survey, the fatigue (3) Parts, the failure of which will
strength of that part of the system is significantly lower the airworthiness or safe
substantiated by analysis or tests, or both. handling of the aeroplane must be proved by
suitable testing, taking into account the most
(7) The elements of the system must be
critical combination of pressures and temperatures
able to withstand the loads due to the pressure
which are applicable.
given in Appendix K, for the proof condition
without leakage or permanent distortion and for
the ultimate condition without rupture.
CS 25.1438 Pressurisation and low
Temperature must be those corresponding to
pressure pneumatic
normal operating conditions. Where elements are
systems
constructed from materials other than aluminium
alloy, tungum, or medium-strength steel, the Pneumatic systems (ducting and components) served
Authority may prescribe or agree other factors. by bleed air, such as engine bleed air, air
The materials used should in all cases be resistant conditioning, pressurisation, engine starting and hot-
to deterioration arising from the environmental air ice-protection systems, which are essential for the
conditions of the installation, particularly the safe operation of the aeroplane or whose failure may
effects of vibration. adversely affect any essential or critical part of the
aeroplane or the safety of the occupants, must be so
(8) Where any part of the system is
designed and installed as to comply the CS 25.1309
subject to fluctuating or repeated external or
In particular account must be taken of bursting or
internal loads, adequate allowance must be made
excessive leakage. (See AMC 25.1438 paragraph 1
for fatigue.
for strength and AMC 25.1438 paragraph 2 for
(c) Tests testing.)
(1) A complete pneumatic system must be
static tested to show that it can withstand a
CS 25.1439 Protective breathing
pressure of 1·5 times the working pressure
equipment
without a deformation of any part of the system
that would prevent it from performing its intended (a) Protective breathing equipment must be
function. Clearance between structural members installed for use of appropriate crewmembers. Such
and pneumatic system elements must be adequate equipment must be located so as to be available for
and there must be no permanent detrimental use in compartments accessible in flight.
deformation. For the purpose of this test, the
(b) For protective breathing equipment required
pressure relief valve may be made inoperable to
by CS 25.1439 (a) or by the Operating Regulations,
permit application of the required pressure.
the following apply:
(2) The entire system or appropriate sub-
(1) The equipment must be designed to
systems must be tested in an aeroplane or in a
protect the appropriate crewmember from smoke,
mock-up installation to determine proper
carbon dioxide, and other harmful gases while on
performance and proper relation to other
flight deck duty or while combating fires.
aeroplane systems. The functional tests must
include simulation of pneumatic system failure (2) The equipment must include –
conditions. The tests must account for flight
(i) Masks covering the eyes, nose
loads, ground loads, and pneumatic system
and mouth, or
working, limit and transient pressures expected
during normal operation, but need not account for (ii) Masks covering the nose and
vibration loads or for loads due to temperature mouth, plus accessory equipment to cover
effects. Endurance tests must simulate the the eyes.
repeated complete flights that could be expected
1–F–18
BOOK 1 CS–25
(3) Equipment, including portable supplemental oxygen required for each crew member
equipment, while in use must allow may not be less than the flow required to maintain,
communication with other crewmembers. during inspiration, a mean tracheal oxygen partial
Equipment available at flight crew assigned duty pressure of 122 mmHg, up to and including a cabin
stations must enable the flight crew to use radio pressure altitude of 10668 m (35 000 ft), and 95%
equipment. oxygen between cabin pressure altitudes of 10668 m
(35 000) and 12192 m (40 000 ft), when breathing 20
(4) The part of the equipment protecting
litres per minute BTPS. In addition, there must be
the eyes may not cause any appreciable adverse
means to allow the crew to use undiluted oxygen at
effect on vision and must allow corrective glasses
their discretion.
to be worn.
(c) For passengers and cabin crew members, the
(5) Each dispensing equipment must
minimum mass flow of supplemental oxygen
supply protective oxygen of 15 minutes duration
required for each person at various cabin pressure
at a pressure altitude of 2438 m (8000 ft) with a
altitudes may not be less than the flow required to
respiratory minute volume of 30 litres per minute
maintain, during inspiration and while using the
BTPD. The equipment and system must be
oxygen equipment (including masks) provided, the
designed to prevent any leakage to the inside of
following mean tracheal oxygen partial pressures:
the mask and any significant increase in the
oxygen content of the local ambient atmosphere. (1) At cabin pressure altitudes above
(See AMC 25.1439 (b)(5).) 3048 m (10 000 ft) up to and including 5639 m
(18,500 ft), a mean tracheal oxygen partial
(6) The equipment must meet the
pressure of 100 mmHg when breathing 15 litres
requirements of CS 25.1441.
per minute, BTPS, and with a tidal volume of 700
cm3 with a constant time interval between
respirations.
CS 25.1441 Oxygen equipment and
supply (2) At cabin pressure altitudes above
5639 m (18 500 ft) up to and including 12192 m
(a) If certification with supplemental oxygen
(40,000 ft), a mean tracheal oxygen partial
equipment is requested, the equipment must meet the
pressure of 83·8 mmHg when breathing 30 litres
requirements of this paragraph and CS 25.1443
per minute, BTPS, and with a tidal volume of
through 25.1453.
1100 cm3 with a constant time interval between
(b) The oxygen system must be free from respirations.
hazards in itself, in its method of operation, and in its
(d) If first-aid oxygen equipment is installed,
effect upon other components.
the minimum mass flow of oxygen to each user may
(c) There must be a means to allow the crew not be less than 4 litres per minute, STPD. However,
to readily determine, during flight, the quantity of there may be a means to decrease this flow to not less
oxygen available in each source of supply. than 2 litres per minute, STPD, at any cabin altitude.
The quantity of oxygen required is based upon an
(d) The oxygen flow rate and the oxygen
average flow rate of 3 litres per minute per person for
equipment for aeroplanes for which certification for
whom first-aid oxygen is required.
operation above 12192 m (40 000 ft) is requested
must be approved. (See AMC 25.1441(d).) (e) If portable oxygen equipment is installed for
use by crew members, the minimum mass flow of
supplemental oxygen is the same as specified in sub-
CS 25.1443 Minimum mass flow of paragraph (a) or (b) of this paragraph, whichever is
supplemental oxygen applicable.
(a) If continuous flow equipment is installed for
use by flight-crew members, the minimum mass flow
CS 25.1445 Equipment standards for
of supplemental oxygen required for each crew
the oxygen distributing
member may not be less than the flow required to
system
maintain, during inspiration, a mean tracheal oxygen
partial pressure of 149 mmHg when breathing 15 (a) When oxygen is supplied to both crew and
litres per minute, BTPS, and with a maximum tidal passengers, the distribution system must be designed
volume of 700 cm3 with a constant time interval for either –
between respirations.
(1) A source of supply for the flight crew
(b) If demand equipment is installed for use by on duty and a separate source for the passengers
flight-crew members, the minimum mass flow of and other crew members; or
1–F–19
CS–25 BOOK 1
(2) A common source of supply with him when seated at his station, and this is
means to separately reserve the minimum supply designed and installed so that it (see AMC
required by the flight crew on duty. 25.1447 (c)(2)) –
(b) Portable walk-around oxygen units of the (i) Can be placed on the face from
continuous flow, diluter demand, and straight its ready position, properly secured, sealed,
demand kinds may be used to meet the crew or and supplying oxygen upon demand, with
passenger breathing requirements. one hand within 5 seconds and without
disturbing eyeglasses or causing delay in
proceeding with emergency duties; and
CS 25.1447 Equipment standards for
(ii) Allows, while in place, the
oxygen dispensing units
performance of normal communication
If oxygen-dispensing units are installed, the functions.
following apply:
(3) There must be at least two outlets and
(a) There must be an individual dispensing unit units of dispensing equipment of a type similar to
for each occupant for whom supplemental oxygen is that required by sub-paragraph (c)(1) of this
to be supplied. Units must be designed to cover the paragraph in all other compartments or work areas
nose and mouth and must be equipped with a suitable that may be occupied by passengers or crew
means to retain the unit in position on the face. Flight members during flight, i.e. toilets, washrooms,
crew masks for supplemental oxygen must have galley work areas, etc.
provisions for the use of communication equipment.
(4) Portable oxygen equipment must be
(b) If certification for operation up to and immediately available for each cabin
including 7620 m (25 000 ft) is requested, an oxygen crewmember. (See AMC 25.1447 (c)(4).)
supply terminal and unit of oxygen dispensing
equipment for the immediate use of oxygen by each
crew member must be within easy reach of that crew
CS 25.1449 Means for determining use
member. For any other occupants the supply
of oxygen
terminals and dispensing equipment must be located
to allow use of oxygen as required by the operating There must be a means to allow the crew to
rules. determine whether oxygen is being delivered to the
dispensing equipment.
(c) If certification for operation above 7620 m
(25 000 ft) is requested, there must be oxygen
dispensing equipment meeting the following
CS 25.1450 Chemical oxygen
requirements (See AMC 25.1447(c)):
generators
(1) There must be an oxygen-dispensing
(a) For the purpose of this paragraph, a
unit connected to oxygen supply terminals
chemical oxygen generator is defined as a device,
immediately available to each occupant, wherever
which produces oxygen, by chemical reaction.
seated. If certification for operation above 9144
m (30 000 ft) is requested, the dispensing units (b) Each chemical oxygen generator must be
providing the required oxygen flow must be designed and installed in accordance with the
automatically presented to the occupants before following requirements:
the cabin pressure altitude exceeds 4572 m
(1) Surface temperature developed by the
(15 000 ft) and the crew must be provided with a
generator during operation may not create a
manual means to make the dispensing units
hazard to the aeroplane or to its occupants.
immediately available in the event of failure of
the automatic system. The total number of (2) Means must be provided to relieve
dispensing units and outlets must exceed the any internal pressure that may be hazardous.
number of seats by at least 10%. The extra units
(c) In addition to meeting the requirements in
must be as uniformly distributed throughout the
sub-paragraph (b) of this paragraph, each portable
cabin as practicable. (See AMC 25.1447(c)(1).)
chemical oxygen generator that is capable of
(2) Each flight-crew member on flight sustained operation by successive replacement of a
deck duty must be provided with demand generator element must be placarded to show –
equipment. In addition, each flight-crew member
(1) The rate of oxygen flow, in litres per
must be provided with a quick-donning type of
minute;
oxygen dispensing unit, connected to an oxygen
supply terminal, that is immediately available to
1–F–20
BOOK 1 CS–25
1–F–21
CS–25 BOOK 1
interphone, public address system or radio aeroplane, or at a distance forward or aft of these
transmitters are in use. limits that does not exceed 25% of the aeroplanes
mean aerodynamic chord;
(d) Each cockpit voice recorder must be
installed so that – (3) It receives its electrical power from
the bus that provides the maximum reliability for
(1) It receives its electric power from the
operation of the flight recorder without
bus that provides the maximum reliability for
jeopardising service to essential or emergency
operation of the cockpit voice recorder without
loads;
jeopardising service to essential or emergency
loads; (4) There is an aural or visual means for
pre-flight checking of the recorder for proper
(2) There is an automatic means to
recording of data in the storage medium (see
simultaneously stop the recorder and prevent each
AMC 25.1459 (a)(4));
erasure feature from functioning, within 10
minutes after crash impact; and (5) Except for recorders powered solely
by the engine-driven electrical generator system,
(3) There is an aural or visual means for
there is an automatic means to simultaneously
pre-flight checking of the recorder for proper
stop a recorder that has a data erasure feature and
operation.
prevent each erasure feature from functioning,
(e) The record container must be located and within 10 minutes after crash impact; and
mounted to minimise the probability of rupture of the
(6) There is a means to record data from
container as a result of crash impact and consequent
which the time of each radio transmission either to
heat damage to the record from fire. In meeting this
or from ATC can be determined.
requirement, the record container must be as far aft
as practicable, but may not be where aft mounted (b) Each non-ejectable record container must be
engines may crush the container during impact. located and mounted so as to minimise the
However, it need not be outside of the pressurised probability of container rupture resulting from crash
compartment. impact and subsequent damage to the record from
fire. In meeting this requirement the record
(f) If the cockpit voice recorder has a bulk
container must be located as far aft as practicable,
erasure device, the installation must be designed to
but need not be aft of the pressurised compartment,
minimise the probability of inadvertent operation and
and may not be where aft-mounted engines may
actuation of the device during crash impact.
crush the container upon impact. (See AMC 25.1459
(g) Each recorder container must – (b).)
(1) Be either bright orange or bright (c) A correlation must be established between
yellow; the flight recorder readings of airspeed, altitude, and
heading and the corresponding readings (taking into
(2) Have reflective tape affixed to its
account correction factors) of the first pilot’s
external surface to facilitate its location under
instruments. The correlation must cover the airspeed
water; and
range over which the aeroplane is to be operated, the
(3) Have an underwater locating device, range of altitude to which the aeroplane is limited,
when required by the operating rules, on or and 360º of heading. Correlation may be established
adjacent to the container which is secured in such on the ground as appropriate.
a manner that they are not likely to be separated
(d) Each recorder container must –
during crash impact.
(1) Be either bright orange or bright
yellow;
CS 25.1459 Flight recorders
(2) Have reflective tape affixed to its
(a) Each flight recorder required by the external surface to facilitate its location under
operating rules must be installed so that – water; and
(1) It is supplied with airspeed, altitude, (3) Have an underwater locating device,
and directional data obtained from sources that when required by the operating rules of this
meet the accuracy requirements of CS 25.1323, chapter, on or adjacent to the container which is
25.1325 and 25.1327, as appropriate; secured in such a manner that they are not likely
to be separated during crash impact.
(2) The vertical acceleration sensor is
rigidly attached, and located longitudinally either (e) Any novel or unique design or operational
within the approved centre of gravity limits of the characteristics of the aircraft must be evaluated to
1–F–22
BOOK 1 CS–25
1–F–23
CS–25 BOOK 1
1–F–24
BOOK 1 CS–25
1-G-1
CS–25 BOOK 1
CS 25.1519 Weight, centre of gravity and be specified as operating limitations for the
weight distribution aeroplane.
The aeroplane weight, centre of gravity, and weight
distribution limitations determined under CS 25.23
CS 25.1523 Minimum flight crew
to CS 25.27 must be established as operating
limitations. (See AMC 25.1519.) The minimum flight crew must be established (see
AMC 25.1523) so that it is sufficient for safe
operation, considering –
(a) The workload on individual crew members;
CS 25.1521 Powerplant limitations
(b) The accessibility and ease of operation of
(See AMC 25.1521)
necessary controls by the appropriate crew member;
(a) General. The powerplant limitations and
prescribed in this paragraph must be established so
(c) The kind of operation authorised under CS
that they do not exceed the corresponding limits for
25.1525.
which the engines or propellers are type certificated
and do not exceed the values on which compliance The criteria used in making the determinations
with any other requirement of this Code is based. required by this paragraph are set forth in Appendix
D.
(b) Reserved.
(c) Turbine engine installations. Operating
limitations relating to the following must be CS 25.1525 Kinds of operation
established for turbine engine installations:
The kinds of operation to which the aeroplane is
(1) Horsepower, torque or thrust, rpm, limited are established by the category in which it is
gas temperature, and time for – eligible for certification and by the installed
equipment.
(i) Maximum continuous power or
thrust (relating to augmented or
unaugmented operation as applicable).
CS 25.1527 Ambient air temperature
(ii) Take-off power or thrust and operating altitude
(relating to augmented or unaugmented
The extremes of the ambient air temperature and
operation as applicable).
operating altitude for which operation is allowed, as
(2) Fuel designation or specification. limited by flight, structural, powerplant, functional,
or equipment characteristics, must be established.
(3) Any other parameter for which a
limitation has been established as part of the
engine type certificate except that a limitation
CS 25.1529 Instructions for Continued
need not be established for a parameter that
Airworthiness
cannot be exceeded during normal operation due
to the design of the installation or to another Instructions for Continued Airworthiness in
established limitation. accordance with Appendix H must be prepared .
(d) Ambient temperature. An ambient
temperature limitation (including limitations for
CS 25.1531 Manoeuvring flight load
winterisation installations, if applicable) must be
factors
established as the maximum ambient atmospheric
temperature established in accordance with CS Load factor limitations, not exceeding the positive
25.1043(b). limit load factors determined from the manoeuvring
diagram in CS 25.333 (b), must be established.
1-G-2
BOOK 1 CS–25
CS 25.1541 General
CS 25.1549 Powerplant instruments
(See AMC 25.1541)
(See AMC 25.1549)
(a) The aeroplane must contain –
For each required powerplant instrument, as
(1) The specified markings and placards; appropriate to the type of instrument:
and
(a) Each maximum and, if applicable, minimum
(2) Any additional information, safe operating limit must be marked with a red radial
instrument markings, and placards required for the or a red line;
safe operation if there are unusual design,
(b) Each normal operating range must be
operating, or handling characteristics.
marked with a green arc or green line, not extending
(b) Each marking and placard prescribed in sub- beyond the maximum and minimum safe limits;
paragraph (a) of this paragraph –
(c) Each take-off and precautionary range must
(1) Must be displayed in a conspicuous be marked with a yellow arc or a yellow line; and
place; and
1-G-3
CS–25 BOOK 1
(d) Each engine or propeller speed range that is CS 25.1557 Miscellaneous markings
restricted because of excessive vibration stresses and placards
must be marked with red arcs or red lines.
(a) Baggage and cargo compartments and
ballast location. Each baggage and cargo
compartment, and each ballast location must have a
CS 25.1551 Oil quantity indicator
placard stating any limitations on contents, including
Each oil quantity indicating means must be marked to weight, that are necessary under the loading
indicate the quantity of oil readily and accurately. requirements. However, underseat compartments
designed for the storage of carry-on articles weighing
not more than 9 kg (20 lb) need not have a loading
CS 25.1553 Fuel quantity indicator limitation placard. (See AMC 25.1557 (a).)
If the unusable fuel supply for any tank exceeds 3.8 l (b) Powerplant fluid filler openings. The
(one gallon), or 5% of the tank capacity, whichever following apply:
is greater, a red arc must be marked on its indicator
(1) Fuel filler openings must be marked at
extending from the calibrated zero reading to the
or near the filler cover with –
lowest reading obtainable in level flight.
(i) The word ‘fuel’;
(ii) Reserved.
CS 25.1555 Control markings
(iii) The permissible fuel
(a) Each cockpit control, other than primary
designations; and
flight controls and controls whose function is
obvious, must be plainly marked as to its function (iv) For pressure fuelling systems,
and method of operation. the maximum permissible fuelling supply
pressure and the maximum permissible
(b) Each aerodynamic control must be marked
defuelling pressure.
under the requirements of CS 25.677 and 25.699.
(2) Oil filler openings must be marked at
(c) For powerplant fuel controls –
or near the filler cover with the word ‘oil’.
(1) Each fuel tank selector control must
(3) Augmentation fluid filler openings
be marked to indicate the position corresponding
must be marked at or near the filler cover to
to each tank and to each existing cross feed
identify the required fluid.
position;
(c) Emergency exit placards. Each emergency
(2) If safe operation requires the use of
exit placard must meet the requirements of CS
any tanks in a specific sequence, that sequence
25.811.
must be marked on, or adjacent to, the selector for
those tanks; and (d) Doors. Each door that must be used in
order to reach any required emergency exit must
(3) Each valve control for each engine
have a suitable placard stating that the door is to be
must be marked to indicate the position
latched in the open position during take-off and
corresponding to each engine controlled.
landing.
(d) For accessory, auxiliary, and emergency
controls –
CS 25.1561 Safety equipment
(1) Each emergency control (including
each fuel jettisoning and fluid shutoff control) (a) Each safety equipment control to be
must be coloured red; and operated by the crew in emergency, such as controls
for automatic liferaft releases, must be plainly
(2) Each visual indicator required by CS
marked as to its method of operation.
25.729 (e) must be marked so that the pilot can
(b) Each location, such as a locker or
determine at any time when the wheels are locked
compartment, that carries any fire extinguishing,
in either extreme position, if retractable landing
signalling, or other lifesaving equipment must be
gear is used.
marked accordingly.
(c) Stowage provisions for required emergency
equipment must be conspicuously marked to identify
the contents and facilitate the easy removal of the
equipment.
1-G-4
BOOK 1 CS–25
(d) Each liferaft must have obviously marked (2) If an airspeed limitation is based upon
operating instructions. compressibility effects, a statement to this effect
and information as to any symptoms, the probable
(e) Approved survival equipment must be
behaviour of the aeroplane, and the recommended
marked for identification and method of operation.
recovery procedures.
(3) The manoeuvring speed VA and a
CS 25.1563 Airspeed placard statement that full application of rudder and
aileron controls, as well as manoeuvres that
A placard showing the maximum airspeeds for wing-
involve angles of attack near the stall, should be
flap extension for the take-off, approach, and landing
confined to speeds below this value.
positions must be installed in clear view of each
pilot. (4) The flap extended speeds VFE and the
pertinent wing-flap positions and engine powers.
(5) The landing gear operating speed or
AEROPLANE FLIGHT MANUAL
speeds, and a statement explaining the speeds as
defined in CS 25.1515 (a).
CS 25.1581 General
(See AMC 25.1581) (6) The landing gear extended speed VLE,
if greater than VLO, and a statement that this is the
(a) Furnishing information. An aeroplane
maximum speed at which the aeroplane can be
Flight Manual must be furnished with each
safely flown with the landing gear extended.
aeroplane, and it must contain the following :
(b) Powerplant limitations. The following
(1) Information required by CS 25.1583
information must be furnished:
to 25.1587.
(1) Limitations required by CS 25.1521
(2) Other information that is necessary
and CS 25.1522.
for safe operation because of design, operating, or
handling characteristics. (2) Explanation of the limitations, when
appropriate.
(3) Any limitation, procedure, or other
information established as a condition of (3) Information necessary for marking the
compliance with the applicable noise standards. instruments required by CS 25.1549 to 25.1553.
(b) Approved information. Each part of the (c) Weight and loading distribution. The
manual listed in CS 25.1583 to 25.1587 that is weight and centre of gravity limitations established
appropriate to the aeroplane, must be furnished, under CS 25.1519 must be furnished in the aeroplane
verified, and approved, and must be segregated, Flight Manual. All of the following information,
identified, and clearly distinguished from each including the weight distribution limitations
unapproved part of that manual. established under CS 25.1519, must be presented
either in the aeroplane Flight Manual or in a separate
(c) Reserved.
weight and balance control and loading document
(d) Each aeroplane Flight Manual must include that is incorporated by reference in the aeroplane
a table of contents if the complexity of the manual Flight Manual;
indicates a need for it.
(1) The condition of the aeroplane and the
items included in the empty weight as defined in
accordance with CS 25.29.
(2) Loading instructions necessary to
CS 25.1583 Operating limitations
ensure loading of the aeroplane within the weight
(a) Airspeed limitations. The following and centre of gravity limits, and to maintain the
airspeed limitations and any other airspeed loading within these limits in flight.
limitations necessary for safe operation must be
(3) If certification for more than one
furnished.
centre of gravity range is requested, the
(1) The maximum operating limit speed appropriate limitations, with regard to weight and
VMO/MMO and a statement that this speed limit loading procedures, for each separate centre of
may not be deliberately exceeded in any regime of gravity range.
flight (climb, cruise, or descent) unless a higher
(d) Flight crew. The number and functions of
speed is authorised for flight test or pilot training.
the minimum flight crew determined under CS
25.1523 must be furnished.
1-G-5
CS–25 BOOK 1
(e) Kinds of operation. The kinds of operation (e) Information must be furnished that indicates
approved under CS 25.1525 must be furnished. that when the fuel quantity indicator reads ‘zero’ in
level flight, any fuel remaining in the fuel tank
(f) Ambient air temperatures and operating
cannot be used safely in flight.
altitudes. The extremes of the ambient air
temperatures and operating altitudes established (f) Information on the total quantity of usable
under CS 25.1527 must be furnished. fuel for each fuel tank must be furnished.
(g) Reserved.
(h) Additional operating limitations. The CS 25.1587 Performance information
operating limitations established under CS 25.1533
(a) Each aeroplane Flight Manual must contain
must be furnished.
information to permit conversion of the indicated
(i) Manoeuvring flight load factors. The temperature to free air temperature if other than a
positive manoeuvring limit load factors for which the free air temperature indicator is used to comply with
structure is proven, described in terms of the requirements of CS 25.1303 (a) (1).
accelerations, must be furnished.
(b) Each aeroplane Flight Manual must contain
(j) reserved the performance information computed under the
applicable provisions of this CS–25 (including CS
(k) A limitation on the maximum depth of
25.115, 25.123 and 25.125 for the weights, altitudes,
runway contaminants for take-off operation must be
temperatures, wind components, and runway
furnished. (See AMC 25.1583 (k).)
gradients, as applicable) within the operational limits
of the aeroplane, and must contain the following:
CS 25.1585 Operating procedures (1) In each case, the conditions of power,
configuration, and speeds, and the procedures for
(a) Operating procedures must be furnished for
handling the aeroplane and any system having a
–
significant effect on the performance information.
(1) Normal procedures peculiar to the
(2) VSR determined in accordance with
particular type or model encountered in
CS 25.103.
connection with routine operations;
(3) The following performance
(2) Non-normal procedures for
information (determined by extrapolation and
malfunction cases and failure conditions
computed for the range of weights between the
involving the use of special systems or the
maximum landing weight and the maximum take-
alternative use of regular systems; and
off weight):
(3) Emergency procedures for foreseeable
(i) Climb in the landing
but unusual situations in which immediate and
configuration.
precise action by the crew may be expected to
substantially reduce the risk of catastrophe. (ii) Climb in the approach
configuration.
(b) Information or procedures not directly
related to airworthiness or not under the control of (iii) Landing distance.
the crew, must not be included, nor must any
(4) Procedures established under CS
procedure that is accepted as basic airmanship.
25.101 (f) and (g) that are related to the
(c) Information identifying each operating limitations and information required by CS
condition in which the fuel system independence 25.1533 and by this paragraph in the form of
prescribed in CS 25.953 is necessary for safety must guidance material including any relevant
be furnished, together with instructions for placing limitation or information.
the fuel system in a configuration used to show
(5) An explanation of significant or
compliance with that section.
unusual flight or ground handling characteristics
(d) The buffet onset envelopes determined of the aeroplane.
under CS 25.251 must be furnished. The buffet onset
(6) Corrections to indicated values of
envelopes presented may reflect the centre of gravity
airspeed, altitude and outside air temperature.
at which the aeroplane is normally loaded during
cruise if corrections for the effect of different centre (7) An explanation of operational landing
of gravity locations are furnished. runway length factors included in the presentation
of the landing distance, if appropriate.
1-G-6
BOOK 1 CS–25
SUPPLEMENTARY INFORMATION
CS 25.1591 Supplementary
performance information
(See AMC 25.1591)
(a) Supplementary performance information
must be furnished by the manufacturer in an
approved document, in the form of guidance
material, to assist operators in developing suitable
guidance, recommendations or instructions for use by
their flight crews when operating on contaminated
runway surface conditions.
INTENTIONALLY LEFT BLANK
(b) The approved document must clearly
indicate the conditions used for establishing the
contaminated runway performance information. It must
also state to the operator that actual conditions
different from those used for establishing the
contaminated runway performance information, may
lead to different performance.
(c) Supplementary performance information for
runways contaminated with standing water, slush,
loose snow, compacted snow or ice must be
furnished. Information on the effect of runway
contaminants on the expected performance of the
aeroplane during take-off and landing on hard-
surfaced runways must be furnished. If it appears in
the aeroplane Flight Manual, this information must
be segregated, identified as guidance material and
clearly distinguished from the additional operating
limitations of CS 25.1533 and the performance
information of CS 25.1587.
(d) The information required by sub-paragraph
(a) of this paragraph may be established by
calculation or by testing.
1-G-7
CS–25 BOOK 1
1-G-8
BOOK 1 CS–25
1–J–1
CS–25 BOOK 1
1–J–2
BOOK 1 CS–25
1–J–3
CS–25 BOOK 1
CS 25A1045 Cooling test procedures CS 25A1093 Air intake system de-icing and
anti-icing provisions
(a) Compliance with CS 25A1041 must be
shown for the take-off, climb, en-route, and (b) (3) Each non-essential APU air intake
landing stages of flight that correspond to the system which does not comply with CS 25B1093
applicable performance requirements. The (b)(2) will be restricted to use in non-ice
cooling tests must be conducted with the conditions, unless it can be shown that the APU
aeroplane in the configuration, and operating complete with air intake system, if subjected to
under the conditions that are critical relative to icing conditions, will not affect the safe operation
cooling tests, a temperature is ‘stabilised’ when its of the aeroplane.
rate of change is less than 1ºC (2ºF) per minute.
(b) Temperatures must be stabilised under the
conditions from which entry is made into each CS 25A1103 Air intake system ducts
stage of flight being investigated, unless the entry
(a) Each air intake system duct upstream of
condition normally is not one during which
the first stage of the APU compressor must have a
component and APU fluid temperatures would
drain to prevent the hazardous accumulation of
stabilise (in which case, operation through the full
fuel and moisture in the ground attitude. The
entry condition must be conducted before entry
drains may not discharge in locations that might
into the stage of flight being investigated in order
cause a fire hazard.
to allow temperatures to reach their natural levels
at the time of entry). The take-off cooling test
(b) Each air intake system duct must be –
must be preceded by a period during which the
APU component and APU fluid temperatures are (1) Strong enough to prevent air intake
stabilised with the APU operating normally. system failures resulting from reverse flow due
to APU surging; and
(c) Cooling tests for each stage of flight must
be continued until – (2) Fireproof within the APU compart-
ment. Outside the APU compartment the
(1) The component and APU fluid
materials used to form the air intake duct and
temperatures stabilise;
plenum chamber of the APU must be capable of
(2) The stage of flight is completed; or resisting the maximum heat conditions likely to
occur under reverse flow conditions.
(3) An operating limitation is reached.
(c) Each duct connected to components
between which relative motion could exist must
have means for flexibility.
AIR INTAKE SYSTEM
(d) For APU bleed air systems no hazard may
CS 25A1091 Air intake result if a duct rupture or failure occurs at any
point between the APU port and the aeroplane unit
(a) The air intake system for the APU must
served by the bleed air.
supply –
(e) Each APU air intake system duct must be
(1) The air required by the APU under
constructed of materials that will not absorb
each operating condition for which certification
sufficient quantities of flammable fluids such as to
is requested.
create a fire hazard due to ignition caused by
(d) Ingestion reverse flow during surging.
(1) There must be means to prevent
hazardous quantities of fuel leakage or
overflow from drains, vents, or other CS 25A1105 Air intake system screens
components of flammable fluid systems from
If air intake system screens are used –
entering the APU air intake system; and
(c) No screen may be de-iced by alcohol
(2) If operation of a non-essential APU
alone.
with water or slush on the runway, taxiway or
other airport operating surface is to be
approved, it must be shown that such operation
will not affect the safe operation of the
aeroplane.
1–J–4
BOOK 1 CS–25
1–J–5
CS–25 BOOK 1
APU FIRE PROTECTION fluid contained, the design of the system, the
materials used in the tank, the shut-off means, and
CS 25A1181 Designated fire zones: all connections, lines, and controls provide a
regions included degree of safety equal to that which would exist if
the tank or reservoir were outside such a zone.
(a) Designated fire zones are –
(b) There must be at least 13 mm (one-half
(4) Any APU compartment.
inch) of clear airspace between each tank or
(b) Each designated fire zone must meet the reservoir and each firewall or shroud isolating a
requirements of CS 25A1185 through CS designated fire zone.
25A1203.
(c) Absorbent materials close to flammable
fluid system components that might leak must be
covered or treated to prevent the absorption of
CS 25A1183 Lines, fittings and hazardous quantities of fluids.
components
(a) Except as provided in sub-paragraph (b)
of this paragraph, each line, fitting, and other CS 25A1187 Drainage and ventilation of
component carrying flammable fluid in any area fire zones
subject to APU fire conditions, and each
(a) There must be complete drainage of each
component which conveys or contains flammable
part of each designated fire zone to minimise the
fluid in a designated fire zone must be fire
hazards resulting from failure or malfunctioning
resistant, except that flammable fluid tanks and
of any component containing flammable fluids.
supports in a designated fire zone must be
The drainage means must be –
fireproof or be enclosed by a fireproof shield
unless damage by fire to any non-fireproof part (1) Effective under conditions expected
will not cause leakage or spillage of flammable to prevail when drainage is needed; and
fluid. Components must be shielded or located to
(2) Arranged so that no discharged fluid
safeguard against the ignition of leaking
will cause an additional fire hazard.
flammable fluid. An integral oil sump of less than
19 liter (20 quart) capacity need not be fireproof (b) Each designated fire zone must be
nor be enclosed by a fireproof shield. ventilated to prevent the accumulation of
flammable vapours.
(b) Sub-paragraph (a) of this paragraph does
not apply to – (c) No ventilation opening may be where it
would allow the entry of flammable fluids,
(1) Lines and fittings already approved
vapours, or flame from other zones.
as part of an APU, and
(d) Each ventilation means must be arranged
(2) Vent and drain lines, and their
so that no discharged vapours will cause an
fittings, whose failure will not result in, or add
additional fire hazard.
to, a fire hazard.
(e) Unless the extinguishing agent capacity
(c) All components, including ducts, within a
and rate of discharge are based on maximum air
designated fire zone which, if damaged by fire
flow through a zone, there must be means to allow
could result in fire spreading to other regions of
the crew to shut off sources of forced ventilation
the aeroplane, must be fireproof. Those
to any fire zone.
components within a designated fire zone, which
could cause unintentional operation of, or inability
to operate essential services or equipment, must be
fireproof. CS 25A1189 Shut-off means
(a) Each APU compartment specified in CS
25A1181 (a)(4) must have a means to shut off or
CS 25A1185 Flammable fluids otherwise prevent hazardous quantities of fuel, oil,
de-icer, and other flammable fluids, from flowing
(a) Except for the integral oil sumps specified
into, within, or through any designated fire zone,
in CS 25.1013 (a), no tank or reservoir that is a
except that shut-off means are not required for –
part of a system containing flammable fluids or
gases may be in a designated fire zone unless the
1–J–6
BOOK 1 CS–25
(1) Lines forming an integral part of an CS 25A1193 Cowling and nacelle skin
APU and
(a) Each cowling must be constructed and
(2) Oil systems for APU installations in supported so that it can resist any vibration,
which all external components of the oil inertia, and air load to which it may be subjected
system, including the oil tanks, are fireproof. in operation.
(b) The closing of any fuel shut-off valve for (b) Cowling must meet the drainage and
any APU may not make fuel unavailable to the ventilation requirements of CS 25A1187.
main engines.
(d) Each part of the cowling subject to high
(c) Operation of any shut off may not temperatures due to its nearness to exhaust system
interfere with the later emergency operation of parts or exhaust gas impingement must be
other equipment. fireproof.
(d) Each flammable fluid shut-off means and (e) Each aeroplane must –
control must be fireproof or must be located and
protected so that any fire in a fire zone will not (1) Be designed and constructed so that
affect its operation. no fire originating in any APU fire zone can
enter, either through openings or by burning
(e) No hazardous quantity of flammable fluid through external skin, any other zone or region
may drain into any designated fire zone after shut- where it would create additional hazards,
off.
(2) Meet sub-paragraph (e) (1) of this
(f) There must be means to guard against paragraph with the landing gear retracted (if
inadvertent operation of the shut-off means and to applicable), and
make it possible for the crew to reopen the shut-
off means in flight after it has been closed. (3) Have fireproof skin in areas subject
to flame if a fire starts in the APU
(g) Each tank to APU shut-off valve must be compartment.
located so that the operation of the valve will not
be affected by the APU mount structural failure.
(h) Each shut-off valve must have a means to CS 25A1195 Fire extinguisher systems
relieve excessive pressure accumulation unless a
means for pressure relief is otherwise provided in (a) There must be a fire extinguisher system
the system. serving the APU compartment.
(b) The fire extinguishing system, the
quantity of the extinguishing agent, the rate of
CS 25A1191 Firewalls discharge, and the discharge distribution must be
adequate to extinguish fires. An individual ‘one
(a) Each APU must be isolated from the rest
shot’ system is acceptable. (See AMC 25A1195
of the aeroplane by firewalls, shrouds, or
(b).)
equivalent means.
(c) The fire-extinguishing system for an APU
(b) Each firewall and shroud must be –
compartment must be able to simultaneously
(1) Fireproof; protect each zone of the APU compartment for
which protection is provided.
(2) Constructed so that no hazardous
quantity of air, fluid, or flame can pass from the
compartment to other parts of the aeroplane;
(3) Constructed so that each opening is
CS 25A1197 Fire extinguishing agents
sealed with close fitting fireproof grommets,
bushings, or firewall fittings; and (a) Fire extinguishing agents must –
(4) Protected against corrosion. (1) Be capable of extinguishing flames
emanating from any burning of fluids or other
combustible materials in the area protected by
the fire extinguishing system; and
1–J–7
CS–25 BOOK 1
CS 25A1199 Extinguishing agent containers (2) There is a means to warn the crew
in the event that the sensor or associated wiring
(a) Each extinguishing agent container must within a designated fire zone is severed at one
have a pressure relief to prevent bursting of the point, unless the system continues to function
container by excessive internal pressures. as a satisfactory detection system after the
(b) The discharge end of each discharge line severing; and
from a pressure relief connection must be located (3) There is a means to warn the crew in the
so that discharge of the fire extinguishing agent event of a short circuit in the sensor or associated
would not damage the aeroplane. The line must wiring within a designated fire zone, unless the
be located or protected to prevent clogging caused system continues to function as a satisfactory
by ice or other foreign matter. detection system after the short circuit.
(c) There must be a means for each fire (c) No fire or overheat detector may be
extinguishing agent container to indicate that the
affected by any oil, water, other fluids, or fumes
container has discharged or that the charging
that might be present.
pressure is below the established minimum
necessary for proper functioning. (d) There must be means to allow the crew to
check, in flight, the functioning of each fire or
(d) The temperature of each container must
overheat detector electric circuit.
be maintained, under intended operating
conditions, to prevent the pressure in the container (e) Wiring and other components of each fire
from – or overheat detector system in a fire zone must be
at least fire-resistant.
(1) Falling below that necessary to
provide an adequate rate of discharge; or (f) No fire or overheat detector system
component for any fire zone may pass through
(2) Rising high enough to cause
another fire zone, unless –
premature discharge.
(1) It is protected against the possibility
(e) If a pyrotechnic capsule is used to
of false warnings resulting from fires in zones
discharge the extinguishing agent, each container
through which it passes; or
must be installed so that temperature conditions
will not cause hazardous deterioration of the (2) Each zone involved is
pyrotechnic capsule. simultaneously protected by the same detector
and extinguishing system.
1–J–8
BOOK 1 CS–25
1–J–9
CS–25 BOOK 1
1–J–10
BOOK 1 CS–25
Part B – Essential APUs* unusable fuel supply for that tank under the
requirements of CS 25.959 plus that necessary
GENERAL to show compliance with this paragraph.
(3) Each main pump must be used that
CS 25B903 Auxiliary power units
is necessary for each operating condition and
(e) Restart capability attitude for which compliance with this
paragraph is shown, and the appropriate
(1) Means to restart any APU in flight
emergency pump must be substituted for each
must be provided.
main pump so used.
(2) An altitude and airspeed envelope
(4) If there is a fuel flowmeter, it must
must be established for in-flight APU
be blocked and the fuel must flow through the
restarting, and the APU must have a restart
meter or its bypass. (See AMC 25.955 (a)(4).)
capability within that envelope. (See AMC
25B903(e)(2).) (b) If an APU can be supplied with fuel from
more than one tank, the fuel system must –
(2) For the APU, in addition to having
FUEL SYSTEM appropriate manual switching capability, be
designed to prevent interruption of fuel flow to
CS 25B951 General the APU, without attention by the flight crew,
when any tank supplying fuel to the APU is
(a) Each fuel system must be constructed and
depleted of usable fuel during normal operation
arranged to ensure a flow of fuel at a rate and
and any other tank, that normally supplies fuel
pressure established for proper auxiliary power
to the APU alone, contains usable fuel.
unit functioning under each likely operating
condition, including any manoeuvre for which
certification is requested and during which the
APU is permitted to be in operation. CS 25B961 Fuel system hot weather
operation
(b) Each fuel system must be arranged so that
any air which is introduced into the system will (a) The fuel supply of an APU must perform
not result in – satisfactorily in hot weather operation. It must be
shown that the fuel system from the tank outlet to
(2) Flameout of the APU.
the APU is pressurised under all intended
(c) Each fuel system must be capable of operations so as to prevent vapour formation.
sustained operation throughout its flow and Alternatively, it must be shown that there is no
pressure range with fuel initially saturated with evidence of vapour lock or other malfunctioning
water at 26·7°C (80°F) and having 0.20 cm3 (0·75 during a climb from the altitude of the airport
cc) of free water per liter (US gallon) added and selected by the applicant to the maximum altitude
cooled to the most critical condition for icing established as an operating limitation under CS
likely to be encountered in operation. 25.1527, with the APU operating at the most
critical conditions for vapour formation but not
exceeding the maximum essential load conditions.
If the fuel supply is dependant on the same fuel
CS 25B955 Fuel flow
pumps or fuel supply as the main engines, the
(a) The fuel system must provide at least main engines must be operated at maximum
100% of the fuel flow required under each continuous power.
intended operating condition and manoeuvre.
(5) The fuel temperature must be at
Compliance must be shown as follows:
least 43ºC (110ºF) at the start of the climb.
(1) Fuel must be delivered to the APU (See AMC 25B961(a)(5).)
at a pressure within the limits specified in the
(b) The test prescribed in sub-paragraph (a)
APU type approval.
of this paragraph may be performed in flight or on
(2) The quantity of fuel in the tank may the ground under closely simulated flight
not exceed the amount established as the conditions. If a flight test is performed in weather
cold enough to interfere with the proper conduct
*A definition of an essential APU is given in CS–APU. of the test, the fuel tank surfaces, fuel lines, and
other fuel system parts subject to cold air must be
1–J–11
CS–25 BOOK 1
insulated to simulate, insofar as practicable, flight (c) Be mounted so that its weight is not
in hot weather. supported by the connecting lines or by the inlet
or outlet connections of the strainer or filter itself;
and
CS 25B977 Fuel tank outlet (d) Have the capacity (with respect to
operating limitations established for the APU) and
(a) There must be a fuel strainer for the fuel
the mesh to ensure that APU fuel system
tank outlet or for the booster pump. This strainer
functioning is not impaired, with the fuel
must –
contaminated to a degree (with respect to particle
(2) For the APU, prevent the passage of size and density) that is greater than that
any object that could restrict fuel flow or established for the APU in CS–APU, Book 1,
damage any fuel system component. Section B, CS-APU.250(a).
(c) The clear area of each fuel tank outlet
strainer must be at least five times the area of the OIL SYSTEM
outlet line.
CS 25B1011 General
(d) The diameter of each strainer must be at
least that of the fuel tank outlet. (b) The usable oil capacity may not be less
than the product of the endurance of the aeroplane
(e) Each finger strainer must be accessible
under critical operating conditions and the
for inspection and cleaning.
approved maximum allowable oil consumption of
the APU under the same conditions, plus a
FUEL SYSTEM COMPONENTS suitable margin to ensure system circulation.
1–J–12
BOOK 1 CS–25
EQUIPMENT
1–J–13
CS–25 BOOK 1
1–J–14
BOOK 1 CS–25
APPENDICES
Appendix A
1–App A–1
CS–25 BOOK 1
Appendix A (continued)
1–App A–2
BOOK 1 CS–25
Appendix A (continued)
1–App A–3
CS–25 BOOK 1
Appendix A (continued)
1–App A–4
BOOK 1 CS–25
Appendix A (continued)
1–App A–5
CS–25 BOOK 1
1–App A–6
BOOK 1 CS–25
Appendix C
1–App C–1
CS–25 BOOK 1
FIGURE 1
Source of data – NACA TN No. 1855, Class III –M, Continuous Maximum.
1–App C–2
BOOK 1 CS–25
Appendix C (continued)
FIGURE 2
1–App C–3
CS–25 BOOK 1
Appendix C (continued)
FIGURE 3
1–App C–4
BOOK 1 CS–25
Appendix C (continued)
FIGURE 4
1–App C–5
CS–25 BOOK 1
Appendix C (continued)
FIGURE 5
1–App C–6
BOOK 1 CS–25
Appendix C (continued)
FIGURE 6
1–App C–7
CS–25 BOOK 1
1–App C–8
BOOK 1 CS–25
Appendix D
Criteria for determining minimum flight crew. station, including: observation of systems,
The following are considered by the Agency in emergency operation of any control, and
determining the minimum flight crew under CS emergencies in any compartment.
25.1523.
(7) The degree of automation provided
(a) Basic workload functions. The following in the aircraft systems to afford (after failures
basic workload functions are considered: or malfunctions) automatic crossover or
isolation of difficulties to minimise the need for
(1) Flight path control.
flight crew action to guard against loss of
(2) Collision avoidance. hydraulic or electrical power to flight controls
or other essential systems.
(3) Navigation.
(8) The communications and navigation
(4) Communications.
workload.
(5) Operation and monitoring of aircraft
(9) The possibility of increased
engines and systems.
workload associated with any emergency that
(6) Command decisions. may lead to other emergencies.
(b) Workload factors. The following (10) Incapacitation of a flight-crew
workload factors are considered significant when member whenever the applicable operating rule
analysing and demonstrating workload for requires a minimum flight crew of at least two
minimum flight crew determination: pilots.
(1) The accessibility, ease and (c) Kind of operation authorised. The
simplicity of operation of all necessary flight, determination of the kind of operation authorised
power, and equipment controls, including requires consideration of the operating rules under
emergency fuel shutoff valves, electrical which the aeroplane will be operated. Unless an
controls, electronic controls, pressurisation applicant desires approval for a more limited kind
system controls, and engine controls. of operation, it is assumed that each aeroplane
certificated under this CS-25 will operate under
(2) The accessibility and conspicuity of
IFR conditions.
all necessary instruments and failure warning
devices such as fire warning, electrical system
malfunction, and other failure or caution
indicators. The extent to which such
instruments or devices direct the proper
corrective action is also considered.
(3) The number, urgency, and
complexity of operating procedures with
particular consideration given to the specific
fuel management schedule imposed by centre
of gravity, structural or other considerations of
an airworthiness nature, and to the ability of
each engine to operate at all times from a single
tank or source which is automatically
replenished if fuel is also stored in other tanks.
(4) The degree and duration of
concentrated mental and physical effort
involved in normal operation and in diagnosing
and coping with malfunctions and emergencies.
(5) The extent of required monitoring
of the fuel, hydraulic, pressurisation, electrical,
electronic, deicing, and other systems while en
route.
(6) The actions requiring a crew
member to be unavailable at his assigned duty
1–App D–1
CS–25 BOOK 1
1–App D–2
BOOK 1 CS–25
Appendix F
Part I – Test Criteria and Procedures for Showing Compliance with CS 25.853, 25.855 or 25.869
1–App F–1
CS–25 BOOK 1
Appendix F (continued)
1–App F–2
BOOK 1 CS–25
Appendix F (continued)
(4) Vertical test. A minimum of three the aircraft must be face down for the test. The
specimens must be tested and results averaged. specimens must be exposed to a Bunsen or
For fabrics, the direction of weave Tirrill burner with a nominal ⅜-inch (9·5 mm)
corresponding to the most critical flammability I.D. tube adjusted to give a flame of 38 mm
conditions must be parallel to the longest (1½ inches) in height. The minimum flame
dimension. Each specimen must be supported temperature measured by a calibrated
vertically. The specimen must be exposed to a thermocouple pyrometer in the centre of the
Bunsen or Tirril burner with a nominal 9·5 mm flame must be 843°C (1550°F). Suitable
(⅜-inch) I.D. tube adjusted to give a flame of precautions must be taken to avoid draughts.
38 mm (1½ inches) in height. The minimum The flame must be applied for 30 seconds with
flame temperature measured by a calibrated one-third contacting the material at the centre
thermocouple pyrometer in the centre of the of the specimen and then removed. Flame time,
flame must be 843°C (1550°F). The lower glow time, and whether the flame penetrates
edge of the specimen must be (passes through) the specimen must be
19 mm (¾-inch) above the top edge of the recorded.
burner. The flame must be applied to the centre
(7) Sixty-degree test. A minimum of
line of the lower edge of the specimen. For
three specimens of each wire specification
materials covered by sub-paragraph (a)(1)(i) of
(make and size) must be tested. The specimen
Part I of this Appendix, the flame must be
of wire or cable (including insulation) must be
applied for 60 seconds and then removed. For
placed at an angle of 60° with the horizontal in
materials covered by sub-paragraph (a)(1)(ii) of
the cabinet specified in sub-paragraph (3) of
Part I of this Appendix, the flame must be
this paragraph with the cabinet door open
applied for 12 seconds and then removed.
during the test, or must be placed within a
Flame time, burn length, and flaming time of
chamber approximately 61 cm (2 feet) high by
drippings, if any, may be recorded. The burn
31 cm by 31 cm (1 foot by 1 foot), open at the
length determined in accordance with sub-
top and at one vertical side (front), and which
paragraph (7) of this paragraph must be
allows sufficient flow of air for complete
measured to the nearest 2·5 mm (tenth of an
combustion, but which is free from draughts.
inch).
The specimen must be parallel to and
(5) Horizontal test. A minimum of approximately 15 cm (6 inches) from the front
three specimens must be tested and the results of the chamber. The lower end of the specimen
averaged. Each specimen must be supported must be held rigidly clamped. The upper end
horizontally. The exposed surface, when of the specimen must pass over a pulley or rod
installed in the aircraft, must be face down for and must have an appropriate weight attached
the test. The specimen must be exposed to a to it so that the specimen is held tautly
Bunsen or Tirrill burner with a nominal 9·5 mm throughout the flammability test. The test
(⅜-inch) I.D. tube adjusted to give a flame of specimen span between lower clamp and upper
38 mm (1½ inches) in height. The minimum pulley or rod must be 61 cm (24 inches) and
flame temperature measured by a calibrated must be marked 20 cm (8 inches) from the
thermocouple pyrometer in the centre of the lower end to indicate the central point for flame
flame must be 843°C (1550°F). The specimen application. A flame from a Bunsen or Tirrill
must be positioned so that the edge being tested burner must be applied for 30 seconds at the
is centred 19 mm (¾-inch) above the top of the test mark. The burner must be mounted
burner. The flame must be applied for 15 underneath the test mark on the specimen,
seconds and then removed. A minimum of perpendicular to the specimen and at an angle
25 cm (10 inches) of specimen must be used of 30° to the vertical plane of the specimen.
for timing purposes, approximately 38 mm (1½ The burner must have a nominal bore of
inches) must burn before the burning front 9·5 mm (⅜-inch) and be adjusted to provide a
reaches the timing zone, and the average burn 76 mm (3-inch) high flame with an inner cone
rate must be recorded. approximately one-third of the flame height.
The minimum temperature of the hottest
(6) Forty-five degree test. A minimum
portion of the flame, as measured with a
of three specimens must be tested and the
calibrated thermocouple pyrometer, may not be
results averaged. The specimens must be
less than 954°C (1750°F). The burner must be
supported at an angle of 45° to a horizontal
positioned so that the hottest portion of the
surface. The exposed surface when installed in
flame is applied to the test mark on the wire.
1–App F–3
CS–25 BOOK 1
Appendix F (continued)
1–App F–4
BOOK 1 CS–25
Appendix F (continued)
(a) Criteria for Acceptance. Each seat the specimen set before testing less the weight
cushion must meet the following criteria: of the specimen set after testing expressed as
the percentage of the weight before testing.
(1) At least three sets of seat bottom
and seat back cushion specimens must be (b) Test Conditions. Vertical air velocity
tested. should average 13cm/s ± 5 cm/s (25 fpm ± 10
fpm) at the top of the back seat cushion.
(2) If the cushion is constructed with a
Horizontal air velocity should be below 51 mm/s
fire blocking material, the fire blocking
(10 fpm) just above the bottom seat cushion. Air
material must completely enclose the cushion
velocities should be measured with the ventilation
foam core material.
hood operating and the burner motor off.
(3) Each specimen tested must be
(c) Test Specimens
fabricated using the principal components (i.e.
(1) For each test, one set of cushion
foam core, flotation material, fire blocking
specimens representing a seat bottom and seat
material, if used, and dress covering) and
back cushion must be used.
assembly processes (representative seams and
closures) intended for use in the production (2) The seat bottom cushion specimen
articles. If a different material combination is must be 457 ± 3 mm (18 ± 0·125 inches) wide
used for the back cushion than for the bottom by 508 ± 3 mm (20 ± 0·125 inches) deep by
cushion, both material combinations must be 102 ± 3 mm (4 ± 0·125 inches) thick, exclusive
tested as complete specimen sets, each set of fabric closures and seam overlap.
consisting of a back cushion specimen and a
(3) The seat back cushion specimen
bottom cushion specimen. If a cushion,
must be 457 ± 3 mm (18 ± 0·125 inches) wide
including outer dress covering, is demonstrated
by 635 ± 3 mm (25 ± 0·125 inches) high by
to meet the requirements of this Appendix
51 ± 3 mm (2 ± 0·125 inches) thick, exclusive
using the oil burner test, the dress covering of
of fabric closures and seam overlap.
that cushion may be replaced with a similar
dress covering provided the burn length of the (4) The specimens must be conditioned
replacement covering, as determined by the test at 21 ± 2ºC (70 ± 5ºF) 55% ± 10% relative
specified in CS 25.853(b), does not exceed the humidity for at least 24 hours before testing.
corresponding burn length of the dress covering
(d) Test Apparatus. The arrangement of the
used on the cushion subjected to the oil burner
test apparatus is shown in Figure 1 through 5 and
test.
must include the components described in this
(4) For at least two-thirds of the total paragraph. Minor details of the apparatus may
number of specimen sets tested, the burn length vary, depending on the model burner used.
from the burner must not reach the side of the
(1) Specimen Mounting Stand. The
cushion opposite the burner. The burn length
mounting stand for the test specimens consists
must not exceed 43 cm (17 inches). Burn
of steel angles, as shown in Figure 1. The
length is the perpendicular distance from the
length of the mounting stand legs is 305 ± 3mm
inside edge of the seat frame closest to the
(12 ± 0·125 inches). The mounting stand must
burner to the farthest evidence of damage to the
be used for mounting the test specimen seat
test specimen due to flame impingement,
bottom and seat back, as shown in Figure 2.
including areas of partial or complete
The mounting stand should also include a
consumption, charring, or embrittlement, but
suitable drip pan lined with aluminium foil, dull
not including areas sooted, stained, warped, or
side up.
discoloured, or areas where material has shrunk
or melted away from the heat source. (2) Test Burner. The burner to be used
in testing must –
(5) The average percentage weight loss
(i) Be a modified gun type;
must not exceed 10 percent. Also, at least two-
(ii) Have an 80-degree spray angle
thirds of the total number of specimen sets
nozzle nominally rated for 8.5 l/hr (2·25
tested must not exceed 10 percent weight loss.
US gallons/hour) at 690 KPa (100 psi);
All droppings falling from the cushions and
mounting stand are to be discarded before the (iii) Have a 31 cm (12-inch) burner
after-test weight is determined. The percentage cone installed at the end of the draft tube,
weight loss for a specimen set is the weight of with an opening 15 cm (6 inches) high
1–App F–5
CS–25 BOOK 1
Appendix F (continued)
and 28 cm (11 inches) wide, as shown in procedures may determine the before and after
Figure 3; and test weights of each set of seat cushion
specimens within 9 grams (0·02 pound). A
(iv) Have a burner fuel pressure
continuous weighing system is preferred.
regulator that is adjusted to deliver a
nominal 7.6 l/hr (2·0 US gallon/hour) of # (8) Timing Device. A stopwatch or
2 Grade kerosene or equivalent required other device (calibrated to ± 1 second) must be
for the test. used to measure the time of application of the
burner flame and self-extinguishing time or test
(3) Calorimeter
duration.
(i) The calorimeter to be used in
(e) Preparation of Apparatus. Before
testing must be a 0–17·0 Watts/cm2 (0–
calibration, all equipment must be turned on and
15·0 BTU per ft2 sec) calorimeter,
the burner fuel must be adjusted as specified in
accurate ± 3%, mounted in a 15 by 31 cm
sub-paragraph (d)(2).
(6-inch by 12-inch) by 19 mm (0·75 inch)
thick calcium silicate insulating board (f) Calibration. To ensure the proper
which is attached to a steel angle bracket thermal output of the burner, the following test
for placement in the test stand during must be made:
burner calibration, as shown in Figure 4.
(1) Place the calorimeter on the test
(ii) Because crumbling of the stand as shown in Figure 4 at a distance of
insulating board with service can result in 102-±3 mm (4 ± 0·125 inches) from the exit of
misalignment of the calorimeter, the the burner cone.
calorimeter must be monitored and the
(2) Turn on the burner, allow it to run
mounting shimmed, as necessary, to
for 2 minutes for warm-up, and adjust the
ensure that the calorimeter face is flush
burner air intake damper to produce a reading
with the exposed plane of the insulating
of 11·9 ± 0·6 Watts/cm2 (10·5 ± 0·5 BTU per ft2
board in a plane parallel to the exit of the
sec) on the calorimeter to ensure steady state
test burner cone.
conditions have been achieved. Turn off the
(4) Thermocouples. The seven thermo- burner.
couples to be used for testing must be 1.59 to
(3) Replace the calorimeter with the
3.18 mm (0·0625 to 0·125 inch) metal sheathed,
thermocouple rake (Figure 5).
ceramic packed, type K, grounded thermocouples
with a nominal 22 to 30 American wire gauge (4) Turn on the burner and ensure that
(AWG)-size conductor 0·643 mm (0·0253 the thermocouples are reading 1038 ± 38ºC
inches) to 0·254 mm (0·010 inches) diameter. (1900 ± 100ºF) to ensure steady state
The seven thermocouples must be attached to a conditions have been achieved.
steel angle bracket to form a thermocouple rake
(5) If the calorimeter and
for placement in the test stand during burner
thermocouples do not read within range, repeat
calibration as shown in Figure 5.
steps in sub-paragraphs 1 to 4 and adjust the
(5) Apparatus Arrangement. The test burner air intake damper until the proper
burner must be mounted on a suitable stand to readings are obtained. The thermocouple rake
position the exit of the burner cone a distance of and the calorimeter should be used frequently
102 ± 3 mm (4 ± 0·125 inches) from one side of to maintain and record calibrated test
the specimen mounting stand. The burner stand parameters. Until the specific apparatus has
should have the capability of allowing the burner demonstrated consistency, each test should be
to be swung away from the specimen-mounting calibrated. After consistency has been
stand during warm-up periods. confirmed, several tests may be conducted with
the pre-test calibration before and a calibration
(6) Data Recording. A recording
check after the series.
potentiometer or other suitable calibrated
instrument with an appropriate range must be (g) Test Procedures. The flammability of
used to measure and record the outputs of the each set of specimens must be tested as follows:
calorimeter and the thermocouples.
(1) Record the weight of each set of seat
(7) Weight Scale. Weighing Device – bottom and seat back cushion specimens to be
A device must be used that with proper tested to the nearest 9 grams (0·02 pound).
1–App F–6
BOOK 1 CS–25
Appendix F (continued)
1–App F–7
CS–25 BOOK 1
Appendix F (continued)
FIGURE 1
1–App F–8
BOOK 1 CS–25
Appendix F (continued)
FIGURE 2
1–App F–9
CS–25 BOOK 1
Appendix F (continued)
FIGURE 3
1–App F–10
BOOK 1 CS–25
Appendix F (continued)
FIGURE 4
1–App F–11
CS–25 BOOK 1
Appendix F (continued)
FIGURE 5
1–App F–12
BOOK 1 CS–25
Appendix F (continued)
Part III – Test Method to Determine Flame Penetration Resistance of Cargo Compartment Liners
1–App F–13
CS–25 BOOK 1
Appendix F (continued)
50 mm (2 inches) from the sidewall liner panel. (7) Repeat (f)(1) to ensure that the
The burner stand should have the capability of burner is in the correct range.
allowing the burner to be swung away from the
(g) Test Procedure
test specimen during warm-up periods.
(1) Mount a thermocouple of the same
(6) Instrumentation. A recording
type as that used for calibration at a distance of
potentiometer or other suitable instrument with
10 cm (4 inches) above the horizontal (ceiling)
an appropriate range must be used to measure
test specimen. The thermocouple should be
and record the outputs of the calorimeter and
centred over the burner cone.
the thermocouples.
(2) Mount the test specimen on the test
(7) Timing Device. A stopwatch or
stand shown in Figure 1 in either the horizontal
other device must be used to measure the time
or vertical position. Mount the insulating
of flame application and the time of flame
material in the other position.
penetration, if it occurs.
(3) Position the burner so that flames
(e) Preparation of Apparatus. Before
will not impinge on the specimen, turn the
calibration, all equipment must be turned on and
burner on, and allow it to run for 2 minutes.
allowed to stabilize, and the burner fuel flow must
Rotate the burner to apply the flame to the
be adjusted as specified in sub-paragraph (d)(2).
specimen and simultaneously start the timing
(f) Calibration. To ensure the proper device.
thermal output of the burner the following test
(4) Expose the test specimen to the
must be made:
flame for 5 minutes and then turn off the
(1) Remove the burner extension from burner. The test may be terminated earlier if
the end of the draft tube. Turn on the blower flame penetration is observed.
portion of the burner without turning the fuel or
(5) When testing ceiling liner panels,
igniters on. Measure the air velocity using a
record the peak temperature measured 101 mm
hot wire anemometer in the centre of the draft
(4 inches) above the sample.
tube across the face of the opening. Adjust the
damper such that the air velocity is in the range (6) Record the time at which flame
of 7.9 m/s to 9.1 m/s (1550 to 1800 ft/min). If penetration occurs if applicable.
tabs are being used at the exit of the draft tube,
(h) Test Report. The test report must include
they must be removed prior to this
the following:
measurement. Reinstall the draft tube
extension cone. (1) A complete description of the
materials tested including type, manufacturer,
(2) Place the calorimeter on the test
thickness, and other appropriate data.
stand as shown in Figure 2 at a distance of
20 cm (8 inches) from the exit of the burner (2) Observations of the behaviour of the
cone to simulate the position of the horizontal test specimens during flame exposure such as
test specimen. delamination, resin ignition, smoke, etc.,
including the time of such occurrence.
(3) Turn on the burner, allow it to run
for 2 minutes for warm-up, and adjust the (3) The time at which flame penetration
damper to produce a calorimeter reading of 9·1 occurs, if applicable, for each of three
± 0·6 Watts/cm2 (8·0 ± 0·5 BTU per ft2 sec). specimens tested.
(4) Replace the calorimeter with the (4) Panel orientation (ceiling or
thermocouple rake (see Figure 3). sidewall).
(5) Turn on the burner and ensure that
each of the seven thermocouples reads 927ºC ±
38ºC (1700ºF ± 100ºF) to ensure steady state
conditions have been achieved. If the
temperature is out of this range, repeat steps 2
through 5 until proper readings are obtained.
(6) Turn off the burner and remove the
thermocouple rake.
1–App F–14
BOOK 1 CS–25
Appendix F (continued)
1–App F–15
CS–25 BOOK 1
Appendix F (continued)
1–App F–16
BOOK 1 CS–25
Appendix F (continued)
1–App F–17
CS–25 BOOK 1
Appendix F (continued)
Part IV – Test Method to Determine the Heat Release Rate From Cabin Materials Exposed to Radiant Heat
(See AMC Appendix F, Part IV)
1–App F–18
BOOK 1 CS–25
Appendix F (continued)
outside of the holding chamber and can be used from the closed end of the tubing. The tube
to provide accurate positioning of the specimen is inserted into the environmental chamber
face after injection. The front surface of the through a 6·6 mm hole drilled 10 mm above
specimen shall be 100 mm from the closed the upper edge of the window frame. The
radiation doors after injection. tube is supported and positioned by an
adjustable “Z” shaped support mounted
The specimen holder clips onto the
outside the environmental chamber, above
mounted bracket (Figure 3). The mounting
the viewing window. The tube is
bracket is attached to the injection rod by three
positioned above and 20 mm behind the
screws, which pass through a wide area washer
exposed upper edge of the specimen. The
welded onto a 13 mm nut. The end of the
middle hole must be in the vertical plane
injection rod is threaded to screw into the nut
perpendicular to the exposed surface of the
and a 5.1 mm thick wide area washer is held
specimen, which passes through its vertical
between two 13 mm nuts which are adjusted to
centreline and must be pointed toward the
tightly cover the hole in the radiation doors
radiation source. The gas supplied to the
through which the injection rod or calibration
burner must be methane adjusted to
calorimeter pass.
produce flame lengths of 25 mm.
(7) Calorimeter. A total-flux type
(c) Calibration of Equipment
calorimeter must be mounted in the centre of a
13 mm Kaowool “M” board inserted in the (1) Heat Release Rate. A burner as
sample holder must be used to measure the total shown in Figure 4 must be placed over the end
heat flux. The calorimeter must have a view of the lower pilot flame tubing using a gas-tight
angle of 180º and be calibrated for incident connection. The flow of gas to the pilot flame
flux. The calorimeter calibration must be must be at least 99% methane and must be
acceptable to the Agency. accurately metered. Prior to usage, the wet test
meter is properly levelled and filled with
(8) Pilot-Flame Positions. Pilot igni-
distilled water to the tip of the internal pointer
tion of the specimen must be accomplished by
while no gas is flowing. Ambient temperature
simultaneously exposing the specimen to a
and pressure of the water, are based on the
lower pilot burner and an upper pilot burner, as
internal wet test meter temperature. A baseline
described in sub-paragraphs (b)(8)(i) and
flow rate of approximately 1 litre/min. is set
(b)(8)(ii), respectively. The pilot burners must
and increased to higher preset flows of 4, 6, 8,
remain lighted for the entire 5-minute duration
6 and 4 litres/min. The rate is determined by
of the test.
using a stopwatch to time a complete revolution
(i) Lower Pilot Burner. The of the west test meter for both the baseline and
pilot-flame tubing must be 6·3 mm O.D., higher flow, with the flow returned to baseline
0·8 mm wall, stainless steel tubing. A before changing to the next higher flow. The
mixture of 120 cm3/min. of methane and thermopile baseline voltage is measured. The
850 cm3/min. of air must be fed to the gas flow to the burner must be increased to the
lower pilot flame burner. The normal higher preset flow and allowed to burn for 2·0
position of the end of the pilot burner minutes, and the thermopile voltage must be
tubing is 10 mm from and perpendicular measured. The sequence is repeated until all
to the exposed vertical surface of the five values have been determined. The average
specimen. The centreline at the outlet of of the five values must be used as the
the burner tubing must intersect the calibration factor. The procedure must be
vertical centreline of the sample at a point repeated if the percent relative standard
5 mm above the lower exposed edge of deviation is greater than 5%. Calculations are
the specimen. shown in paragraph (f).
(ii) Upper Pilot Burner. The pilot (2) Flux Uniformity. Uniformity of flux
burner must be a straight length of 6·3 mm over the specimen must be checked periodically
O.D., 0·8 mm wall, stainless steel tubing and after each heating element change to
360 mm long. One end of the tubing shall determine if it is within acceptable limits of ±
be closed, and three No. 40 drill holes shall 5%.
be drilled into the tubing, 60 mm apart, for
(d) Sample Preparation
gas ports, all radiating in the same
direction. The first hole must be 5 mm (1) The standard size for vertically
1–App F–19
CS–25 BOOK 1
Appendix F (continued)
mounted specimens is 150 x 150 mm with at least one data point per second must be made
thicknesses up to 45 mm. during the time the specimen is in the
environmental chamber.
(2) Conditioning. Specimens must be
conditioned as described in Part 1 of this (8) The test duration time is five
Appendix. minutes.
(3) Mounting. Only one surface of a (9) A minimum of three specimens
specimen will be exposed during a test. A must be tested.
single layer of 0·025 mm aluminium foil is
(f) Calculations
wrapped tightly on all unexposed sides.
(1) The calibration factor is calculated
(e) Procedure
as follows:
(1) The power supply to the radiant
( F1 − F0 ) ( 210 ⋅ 8 − 22 ) kcal 273 P − Pv mole CH4STP WATT.min kW
panel is set to produce a radiant flux of 3·5 Kh = × × × × × ×
Watts/cm2. The flux is measured at the point, (V1 − V0 ) mole Ta 760 22 ⋅ 41 ⋅ 01433 kcal 1000W
1–App F–20
BOOK 1 CS–25
Appendix F (continued)
1–App F–21
CS–25 BOOK 1
Appendix F (continued)
1–App F–22
BOOK 1 CS–25
Appendix F (continued)
1–App F–23
CS–25 BOOK 1
Appendix F (continued)
1–App F–24
BOOK 1 CS–25
Appendix F (continued)
FIGURE 3.
1–App F–25
CS–25 BOOK 1
Appendix F (continued)
FIGURE 4.
1–App F–26
BOOK 1 CS–25
Appendix F (continued)
1–App F–27
CS–25 BOOK 1
Appendix F (continued)
Part V – Test Method to Determine the Smoke Emission Characteristics of Cabin Materials
1–App F–28
BOOK 1 CS–25
Appendix H
1–App H–1
CS–25 BOOK 1
1–App H–2
BOOK 1 CS–25
Appendix I
I 25.1 General
(a) This Appendix specifies additional
requirements and limitations for aeroplanes
equipped with an engine control system that
automatically resets thrust or power on the
operating engine(s) when any engine fails during
take-off, and for which performance credit is
limited to that of paragraph 25.3 (b) of this
Appendix. When performance credit is not so
limited, Special Conditions will apply.
(b) With the ATTCS system and associated
systems functioning normally as designed, all
applicable requirements of CS-25, except as
provided in this Appendix, must be met without
I 25.3 Performance requirements
requiring any action by the crew to increase thrust
or power. All applicable performance requirements of
CS-25 must be met with the ATTCS system
functioning normally as designed, except that the
I 25.2 Definitions
propulsive thrust obtained from each operating
engine after failure of the critical engine during
(a) Automatic Takeoff Thrust Control System take-off, and the thrust at which compliance with
(ATTCS). An ATTCS system is defined as a the one-engine-inoperative climb requirements in
system which automatically resets thrust or power CS 25.121 (a) and (b) is shown, must be assumed
on the operating engine(s) when any engine fails to be not greater than the lesser of –
during take-off. For the purpose of the
requirements in this Appendix, the ATTCS system (a) The actual propulsive thrust resulting
comprises all elements of equipment necessary for from the initial setting of power or thrust controls
the control and performance of each intended with the ATTCS system functioning normally as
function, including all devices both mechanical designed, without requiring any action by the crew
to increase thrust or power until the aeroplane has
and electrical that sense engine failure, transmit
signals and actuate fuel controls or power levers achieved a height of 122 m (400 feet) above the
of the operating engine(s) to achieve scheduled take-off surface; or
thrust or power increases, the engine control (b) 111 percent of the propulsive thrust
system and devices which furnish cockpit which would have been available at the initial
information on system operation. setting of power or thrust controls in the event of
(b) Critical Time Interval. When conducting failure of the ATTCS system to reset thrust or
an ATTCS take-off, the critical time interval is power, without any action by the crew to increase
between one second before reaching V1, and the thrust or power until the aeroplane has achieved a
point on the gross take-off flight path with all height of 122 m (400 feet) above the take-off
engines operating where, assuming a simultaneous surface.
engine and ATTCS system failure, the resulting Note 1. The limitation of performance credit for
flight path thereafter intersects the gross flight ATTCS system operation to 111 percent of the
path, determined in accordance with CS 25.115, at thrust provided at the initial setting is intended to:
not less than 122 m (400 feet) above the take-off
surface. This definition is shown in the following
figure:
1–App I–1
CS–25 BOOK 1
1–App I–2
BOOK 1 CS–25
Appendix J
Emergency Demonstration
The following test criteria and procedures must be (3) At least 15% of the passenger load
used for showing compliance with JAR 25.803: must be female and over 50 years of age.
(a) The emergency evacuation must be (4) Three life-size dolls, not included as
conducted either during the dark of the night or part of the total passenger load, must be carried
during daylight with the dark of night simulated. by passengers to simulate live infants 2 years
If the demonstration is conducted indoors during old or younger.
daylight hours, it must be conducted with each
(5) Crew members, mechanics, and
window covered and each door closed to minimise
training personnel who maintain or operate the
the daylight effect. Illumination on the floor or
aeroplane in the normal course of their duties,
ground may be used, but it must be kept low and
may not be used as passengers.
shielded against shining into the aeroplane’s
windows or doors. (i) No passenger may be assigned a specific
seat except as the Agency may require. Except as
(b) The aeroplane must be in a normal
required by sub-paragraph (g) of this Appendix,
attitude with landing gear extended.
no employee of the applicant may be seated next
(c) Unless the aeroplane is equipped with an to an emergency exit.
off-wing descent means, stands or ramps may be
(j) Seat belts and shoulder harnesses (as
used for descent from the wing to the ground.
required) must be fastened.
Safety equipment such as mats or inverted life
rafts may be placed on the floor or ground to (k) Before the start of the demonstration,
protect participants. No other equipment that is approximately one-half of the total average
not part of the aeroplane’s emergency evacuation amount of carry-on baggage, blankets, pillows,
equipment may be used to aid the participants in and other similar articles must be distributed at
reaching the ground. several locations in aisles and emergency exit
access ways to create minor obstructions.
(d) Except as provided in paragraph (a) of
this Appendix, only the aeroplane’s emergency (l) No prior indication may be given to any
lighting system may provide illumination. crewmember or passenger of the particular exits to
be used in the demonstration.
(e) All emergency equipment required for the
planned operation of the aeroplane must be (m) There must not be any practising,
installed. rehearsing or description of the demonstration for
the participants nor may any participant have
(f) Each external door and exit, and each
taken part in this type of demonstration within the
internal door or curtain, must be in the take-off
preceding 6 months.
configuration.
(n) The pre take-off passenger briefing
(g) Each crew member must be seated in the
required by the applicable Operating Rules may be
normally assigned seat for take-off and must
given. The passengers may also be advised to
remain in the seat until receiving the signal for
follow directions of crewmembers but not be
commencement of the demonstration. Each
instructed on the procedures to be followed in the
crewmember must be a person having knowledge
demonstration.
of the operation of exits and emergency equipment
and, if compliance with the applicable Operating (o) If safety equipment as allowed by sub-
Rules is also being demonstrated, each cabin paragraph (c) of this Appendix is provided, either
crewmember must be a member of a regularly all passenger and cockpit windows must be
scheduled line crew. blacked out or all of the emergency exits must
have safety equipment in order to prevent
(h) A representative passenger load of
disclosure of the available emergency exits.
persons in normal health must be used as follows:
(p) Not more than 50% of the emergency exits
(1) At least 40% of the passenger load
in the sides of the fuselage of an aeroplane that
must be females.
meets all of the requirements applicable to the
(2) At least 35% of the passenger load required emergency exits for that aeroplane may
must be over 50 years of age. be used for the demonstration. Exits that are not
to be used in the demonstration must have the exit
handle deactivated or must be indicated by red
1–App J–1
CS–25 BOOK 1
Appendix J (continued)
1–App J–2
BOOK 1 CS–25
Appendix K
Strength Value
Pressure vessels connected to a 3·0 PL or 4·0 PL or The lower values are conditional upon
line source of pressure 1·5 PL 2·0 PL justification by a fatigue endurance test from
which a permissible fatigue life is declared,
and upon the ultimate load test being made on
the test specimen used for the fatigue life test.
Pressure vessels not connected to 2·5 PL or 3·0 PL or The lower values are conditional upon
a line source of pressure, e.g. 1·5 PL 2·0 PL justification by a life endurance test of a
emergency vessels inflated from a suitably factored permissible number of
ground source inflation/deflation cycles, including
temperature fluctuation results in a significant
pressure variation, and upon the ultimate load
test being made on the test specimen used for
the life endurance test.
1–App K–1
CS–25 BOOK 1
1–App K–2
EASA Certification Specifications
for
Large Aeroplanes
CS-25
Book 2
2–0–1
CS-25 BOOK 2
2–0–2
BOOK 2 CS–25
AMC – SUBPART B
AMC 25.21(d)
Proof of Compliance)
1 Where variation of the parameter on which a tolerance is permitted will have an appreciable
effect on the test, the result should be corrected to the specified value of the parameter; otherwise no
correction is necessary.
2 In areas of critical handling or stability, notwithstanding the tolerance of CS 25.21(d) (7% total
travel), aft centre of gravity tests should be flown at a centre of gravity not more forward than the
certificate aft centre of gravity limit. Tests which are critical on the forward centre of gravity limit
should be flown at centres of gravity at least as forward as the certificate forward limit.
AMC 25.101
General
The test aeroplane used in the determination of the scheduled performance should be in a condition
which, as far as is reasonably possible, is representative of the average new production aeroplane.
Where the test aeroplane differs from this standard (e.g. with regard to engine idle thrust settings, flap
rigging, etc.) it will be necessary to correct the measured performance for any significant performance
effects of such differences.
The variation of take-off, climb and landing performance with weight may be extrapolated without
conservatism to a weight greater, by up to 10%, than the maximum weight tested and to a weight
lower, by up to 10%, than the lowest weight tested. These ranges may not be applicable if there are
significant discontinuities, or unusual variations, in the scheduling of the relevant speeds with weight,
in the weight ranges covered by extrapolation.
1 GENERAL - CS 25.101
1.1 Explanation - Propulsion System Behaviour. CS 25.101(c) requires that aeroplane “performance
must correspond to the propulsive thrust available under the particular ambient atmospheric
conditions, the particular flight condition, . . .” The propulsion system’s (i.e., turbine engines and
propellers, where appropriate) installed performance characteristics are primarily a function of engine
power setting, airspeed, propeller efficiency (where applicable), altitude, and ambient temperature.
The effects of each of these variables must be determined in order to establish the thrust available for
aeroplane performance calculations.
1.2 Procedures.
1.2.1 The intent is to develop a model of propulsion system performance that covers the approved
flight envelope. Furthermore, it should be shown that the combination of the propulsion system
performance model and the aeroplane performance model are validated by the takeoff performance
test data, climb performance tests, and tests used to determine aeroplane drag. Installed propulsion
system performance characteristics may be established via the following tests and analyses:
a. Steady-state engine power setting vs. thrust (or power) testing. Engines should be equipped with
adequate instrumentation to allow the determination of thrust (or power). Data should be acquired in
2–B–1
CS–25 BOOK 2
order to validate the model, including propeller installed thrust, if applicable, over the range of power
settings, altitudes, temperatures, and airspeeds for which approval is sought. Although it is not
possible to definitively list or foresee all of the types of instrumentation that might be considered
adequate for determining thrust (or power) output, two examples used in past certification programmes
are: (1) engine pressure rakes, with engines calibrated in a ground test cell, and (2) fan speed, with
engines calibrated in a ground test cell and the calibration data validated by the use of a flying test
bed. In any case, the applicant should substantiate the adequacy of the instrumentation to be used for
determining the thrust (or power) output.
b. Lapse rate takeoff testing to characterise the behaviour of power setting, rotor speeds,
propeller effects (i.e., torque, RPM, and blade angle), or gas temperature as a function of time,
thermal state, or airspeed, as appropriate. These tests should include the operation of an Automatic
Takeoff Thrust Control System (ATTCS), if applicable, and should cover the range of power settings
for which approval is sought.
i. Data for higher altitude power settings may be acquired via overboost (i.e., operating at a higher
than normal power setting for the conditions) with the consent of the engine and propeller (when
applicable) manufacturer(s). When considering the use of overboost on turbopropeller propulsion
system installations to simulate higher altitude and ambient temperature range conditions, the
capability to achieve an appropriate simulation should be evaluated based on the engine and propeller
control system(s) and aircraft performance and structural considerations. Engine (gearbox) torque,
rotor speed, or gas temperature limits, including protection devices to prohibit or limit exceedences,
may prevent the required amount of overboost needed for performance at the maximum airport
altitude sought for approval. Overboost may be considered as increased torque, reduced propeller
speed, or a combination of both in order to achieve the appropriate blade angle for the higher altitude
and ambient temperature range simulation. Consideration for extrapolations will depend on the
applicant’s substantiation of the proper turbopropeller propulsion system simulated test conditions.
ii. Lapse rate characteristics should be validated by takeoff demonstrations at the maximum
airport altitude for which takeoff approval is being sought. Alternatively, if overboost (see paragraph (i)
above) is used to simulate the thrust setting parameters of the maximum airport altitude for which
takeoff approval is sought, the takeoff demonstrations of lapse rate characteristics can be performed
at an airport altitude up to 915 m (3,000 feet) lower than the maximum airport altitude.
c. Thrust calculation substantiation. Installed thrust should be calculated via a mathematical model
of the propulsion system, or other appropriate means, adjusted as necessary to match the measured
inflight performance characteristics of the installed propulsion system. The propulsion system
mathematical model should define the relationship of thrust to the power setting parameter over the
range of power setting, airspeed, altitude, and temperature for which approval is sought. For turbojet
aeroplanes, the propulsion system mathematical model should be substantiated by ground tests in
which thrust is directly measured via a calibrated load cell or equivalent means. For turbopropeller
aeroplanes, the engine power measurements should be substantiated by a calibrated dynamometer or
equivalent means, the engine jet thrust should be established by an acceptable engine model, and the
propeller thrust and power characteristics should be substantiated by wind tunnel testing or equivalent
means.
d. Effects of ambient temperature. The flight tests of paragraph 1.2.1.a. above will typically provide
data over a broad range of ambient temperatures. Additional data may also be obtained from other
flight or ground tests of the same type or series of engine. The objective is to confirm that the
propulsion system model accurately reflects the effects of temperature over the range of ambient
temperatures for which approval is being sought (operating envelope). Because thrust (or power) data
can usually be normalised versus temperature using either dimensionless variables (e.g., theta
exponents) or a thermodynamic cycle model, it is usually unnecessary to obtain data over the entire
ambient temperature range. There is no need to conduct additional testing if:
i. The data show that the behaviour of thrust and limiting parameters versus ambient temperature
can be predicted accurately; and
2–B–2
BOOK 2 CS–25
ii. Analysis based upon the test data shows that the propulsion system will operate at rated thrust
without exceeding propulsion system limits.
1.2.2 Extrapolation of propulsion system performance data to 915 m (3,000 feet) above the highest
airport altitude tested (up to the maximum takeoff airport altitude to be approved) is acceptable,
provided the supporting data, including flight test and propulsion system operations data (e.g., engine
and propeller control, limits exceedence, and surge protection devices scheduling), substantiates the
proposed extrapolation procedures. Considerations for extrapolation depend upon an applicant's
determination, understanding, and substantiation of the critical operating modes of the propulsion
system. This understanding includes a determination and quantification of the effects that propulsion
system installation and variations in ambient conditions have on these modes.
2.1 These guidelines are applicable to expanding aeroplane Flight Manual takeoff and landing data
above and below the altitude at which the aeroplane takeoff and landing performance tests are
conducted.
2.2 With installed propulsion system performance characteristics that have been adequately defined
and verified, aeroplane takeoff and landing performance data obtained at one field elevation may be
extrapolated to higher and lower altitudes within the limits of the operating envelope without applying
additional performance conservatisms. It should be noted, however, that extrapolation of the
propulsion system data used in the determination and validation of propulsion system performance
characteristics is typically limited to 915 m (3,000 feet) above the highest altitude at which propulsion
system parameters were evaluated for the pertinent power/thrust setting. (See paragraph 1 of this
AMC for more information on an acceptable means of establishing and verifying installed propulsion
system performance characteristics.)
2.3 Note that certification testing for operation at airports that are above 2438 m (8,000 feet) should
also include functional tests of the cabin pressurisation system. Consideration should be given to any
other systems whose operation may be sensitive to, or dependent upon airport altitude, such as:
engine and APU starting, passenger oxygen, autopilot, autoland, autothrottle system thrust
set/operation."
AMC 25.101(h)(3)
General
CS 25.109(a) and (b) require the accelerate-stop distance to include a distance equivalent to
2 seconds at V1 in addition to the demonstrated distance to accelerate to V1 and then bring the
aeroplane to a full stop. This additional distance is not intended to allow extra time for making a
decision to stop as the aeroplane passes through V 1, but is to account for operational variability in the
time it takes pilots to accomplish the actions necessary to bring the aeroplane to a stop. It allows for
the typical requirement for up to three pilot actions (i.e. brakes – throttles – spoilers) without
introducing additional time delays to those demonstrated. If the procedures require more than three
pilot actions, an allowance for time delays must be made in the scheduled accelerate-stop distance.
These delays, which are applied in addition to the demonstrated delays, are to be 1 second (or 2
seconds if a command to another crew member to take the action is required) for each action beyond
the third action. This is illustrated in Figure 1.
2–B–3
CS–25 BOOK 2
where:–
VEF is the calibrated airspeed selected by the applicant at which the critical engine is assumed to fail.
The relationship between VEF and V1 is defined in CS 25.107.
∆tact 1 = the demonstrated time interval between engine failure and activation of the first deceleration
device. This time interval is defined as beginning at the instant the critical engine is failed and ending
when the pilot recognises and reacts to the engine failure, as indicated by the pilot’s application of the
first retarding means during accelerate-stop tests. A sufficient number of demonstrations should be
conducted using both applicant and Agency test pilots to assure that the time increment is
representative and repeatable. The pilot’s feet should be on the rudder pedals, not the brakes, during
the tests. For AFM data expansion purposes, in order to provide a recognition time increment that can
be executed consistently in service, this time increment should be equal to the demonstrated time or 1
second, whichever is greater. If the aeroplane incorporates an engine failure warning light, the
recognition time includes the time increment necessary for the engine to spool down to the point of
warning light activation, plus the time increment from light ‘on’ to pilot action indicating recognition of
the engine failure.
∆tact 2 = the demonstrated time interval between activation of the first and second deceleration devices.
∆tact 3 = the demonstrated time interval between activation of the second and third deceleration
devices.
∆tact 4→n = the demonstrated time interval between activation of the third and fourth (and any
subsequent) deceleration devices. For AFM expansion, a 1-second reaction time delay to account for
in-service variations should be added to the demonstrated activation time interval between the third
and fourth (and any subsequent) deceleration devices. If a command is required for another crew
member to actuate a deceleration device, a 2-second delay, in lieu of the 1-second delay, should be
applied for each action. For automatic deceleration devices that are approved for performance credit
for AFM data expansion, established systems actuation times determined during certification testing
may be used without the application of the additional time delays required by this paragraph.
AMC 25.101(i)
Performance determination with worn brakes
It is not necessary for all the performance testing on the aircraft to be conducted with fully worn
brakes. Sufficient data should be available from aircraft or dynamometer rig tests covering the range
of wear and energy levels to enable correction of the flight test results to the 100% worn level. The
only aircraft test that should be carried out at a specific brake wear state is the maximum kinetic
2–B–4
BOOK 2 CS–25
energy rejected take-off test of CS 25.109(i), for which all brakes should have not more than 10% of
the allowable brake wear remaining.
AMC 25.103(b)
Stalling Speed
The airplane should be trimmed for hands-off flight at a speed 13 percent to 30 percent above the
anticipated VSR with the engines at idle and the airplane in the configuration for which the stall speed
is being determined. Then, using only the primary longitudinal control for speed reduction, a constant
deceleration (entry rate) is maintained until the airplane is stalled, as defined in CS 25.201(d).
Following the stall, engine thrust may be used as desired to expedite the recovery.
The analysis to determine VCLMAX should disregard any transient or dynamic increases in recorded load
factor, such as might be generated by abrupt control inputs, which do not reflect the lift capability of the
aeroplane. The load factor normal to the flight path should be nominally 1.0 until VCLMAX is reached.
AMC 25.103(c)
Stall Speed
The stall entry rate is defined as the mean rate of speed reduction (in m/s 2 (knots CAS/second)) in the
deceleration to the stall in the particular stall demonstration, from a speed 10% above that stall speed,
i.e.
1⋅ 1 VCLMAX − 1⋅ 0 VCLMAX
Entry Rate = (m/s2 (knots CAS/sec))
Time to decelerate from 1⋅ 1 VCLMAX to VCLMAX
AMC 25.103(d)
Stall Speed
In the case where a device that abruptly pushes the nose down at a selected angle of attack (e.g. a
stick pusher) operates after CLMAX, the speed at which the device operates, stated in CS 25.103(d),
need not be corrected to 1g.
Test procedures should be in accordance with AMC 25.103(b) to ensure that no abnormal or unusual
pilot control input is used to obtain an artificially low device activation speed.
AMC 25.107(d)
Take-off Speeds
1 If cases are encountered where it is not possible to obtain the actual VMU at forward centre of
gravity with aeroplanes having limited elevator power (including those aeroplanes which have limited
elevator power only over a portion of the take-off weight range), it will be permissible to test with a
more aft centre of gravity and/or more than normal nose-up trim to obtain VMU.
1.1 When VMU is obtained in this manner, the values should be corrected to those which would
have been attained at forward centre of gravity if sufficient elevator power had been available. The
variation of VMU with centre of gravity may be assumed to be the same as the variation of stalling
speed in free air with centre of gravity for this correction.
1.2 In such cases where VMU has been measured with a more aft centre of gravity and/or with
more than normal nose-up trim, the VR selected should (in addition to complying with the requirements
of CS 25.107(e)) be greater by an adequate margin than the lowest speed at which the nose wheel
2–B–5
CS–25 BOOK 2
can be raised from the runway with centre of gravity at its most critical position and with the trim set to
the normal take-off setting for the weight and centre of gravity.
NOTE: A margin of 9,3 km/h (5 kt) between the lowest nose-wheel raising speed and VR would normally be considered
to be adequate.
2 Take-offs made to demonstrate VMU should be continued until the aeroplane is out of ground
effect. The aeroplane pitch attitude should not be decreased after lift-off.
AMC 25.107(e)(1)(iv)
Take-off Speeds
1 For aeroplanes that are geometry limited (i.e., the minimum possible VMU speeds are
limited by tail contact with the runway), CS 25.107(e)(1)(iv)(B) allows the VMU to VLOF speed
margins to be reduced to 108% and 104% for the all-engines-operating and one-engine-
inoperative conditions, respectively. The VMU demonstrated must be sound and repeatable.
2.1 During the speed range from 96 to 100% of the actual lift-off speed, the aft under-surface
of the aeroplane should be in contact with the runway. Because of the dynamic nature of the
test, it is recognised that contact will probably not be maintained during this entire speed range,
and some judgement is necessary. It has been found acceptable for contact to exist
approximately 50% of the time that the aeroplane is in this speed range.
2.2 Beyond the point of lift-off to a height of 11m (35 ft), the aeroplane’s pitch attitude should
not decrease below that at the point of lift-off, nor should the speed increase more than 10%.
2.3 The horizontal distance from the start of the take-off to a height of 11 m (35 ft) should not
be greater than 105% of the distance determined in accordance with CS 25.113(a)(2) without the
115% factor.
AMC 25.107(e)(3)
Take-off Speeds
a. Rotation at a speed of VR-9,3 km/h (5 kt) should be carried out using, up to the point of lift-off,
the same rotation technique, in terms of control input, as that used in establishing the one-engine-
inoperative distance of CS 25.113 (a)(1);
b. The engine failure speed used in the VR-9,3 km/h (5 kt) demonstration should be the same as
that used in the comparative take-off rotating at VR;
c. The tests should be carried out both at the lowest practical weight (such that VR-9,3 km/h (5
kt) is not less than VMCG) and at a weight approaching take-off climb limiting conditions;
2–B–6
BOOK 2 CS–25
Reasonably expected variations in service from established take-off procedures should be evaluated
in respect of out-of-trim conditions during certification flight test programmes. For example, normal
take-off should be made with the longitudinal control trimmed to its most adverse position within the
allowable take-off trim band.
1 CS 25.107(e)(4) states that there must be no marked increase in the scheduled take-off
distance when reasonably expected service variations, such as over-rotation, are encountered. This
can be interpreted as requiring take-off tests with all engines operating with an abuse on rotation
speed.
2 The expression ‘marked increase’ in the take-off distance is defined as any amount in excess
of 1% of the scheduled take-off distance. Thus the abuse test should not result in a field length more
than 101% of the scheduled field length.
3 For the early rotation abuse condition with all engines operating and at a weight as near as
practicable to the maximum sea-level take-off weight, it should be shown by test that when the
aeroplane is rotated rapidly at a speed which is 7% or 19 km/h (10 kt), whichever is lesser, below the
scheduled VR speed, no ‘marked increase’ in the scheduled field length would result.
Propeller pitch position. For the one-engine-inoperative accelerate-stop distance, the critical engine’s
propeller should be in the position it would normally assume when an engine fails and the power
levers are closed. For dry runway one-engine-inoperative accelerate-stop distances, the high drag
ground idle position of the operating engines’ propellers (defined by a pitch setting that results in not
less than zero total thrust, i.e. propeller plus jet thrust, at zero airspeed) may be used provided
adequate directional control is available on a wet runway and the related operational procedures
comply with CS 25.109 (f) and (h). Wet runway controllability may either be demonstrated by using the
guidance available in AMC 25.109(f) at the appropriate power level, or adequate control can be
assumed to be available at ground idle power if reverse thrust credit is approved for determining the
wet runway accelerate-stop distances. For the all-engines-operating accelerate-stop distances on a
dry runway, the high drag ground idle propeller position may be used for all engines (subject to CS
25.109(f) and (h)). For criteria relating to reverse thrust credit for wet runway accelerate-stop
distances, see AMC 25.109(f).
AMC 25.109(c)(2)
Accelerate-stop distance: anti-skid system efficiency
CS 25.109(c)(2) identifies 3 categories of anti-skid system and provides for either the use of a default
efficiency value appropriate to the type of system or the determination of a specific efficiency value.
Paragraph 1 of this AMC gives a description of the operating characteristics of each category to
enable the classification of a particular system to be determined. Paragraph 2 gives an acceptable
means of compliance with the requirement for flight testing and use of default efficiency values in
accordance with CS 25.109(c)(2). These values are appropriate where the tuning of the anti-skid
system is largely qualitative and without detailed quantitative analysis of system performance. Where
detailed data recording and analysis is used to optimise system tuning, an efficiency value somewhat
higher than the default value might be obtained and determined. Typically, a value of 40% might be
achieved with an On/Off system. The quasi-modulating category covers a broad range of systems with
2–B–7
CS–25 BOOK 2
varying performance levels. The best quasi-modulating systems might achieve an efficiency up to
approximately 80%. Fully modulating systems have been tuned to efficiencies greater than 80% and
up to a maximum of approximately 92%, which is considered to be the maximum efficiency on a wet
runway normally achievable with fully modulating digital anti-skid systems. Paragraph 3 gives an
acceptable means of compliance with CS 25.109(c)(2) where the applicant elects to determine a
specific efficiency value.
In Paragraph 4 of this AMC, guidance is given on the use of 2 alternative methods for calculating anti-
skid system efficiency from the recorded data. One method is based on the variation of brake torque
throughout the stop, while the other is based on wheel speed slip ratio. Finally, Paragraph 5 gives
guidance on accounting for the distribution of the normal load between braked and unbraked wheels.
1.1 For the purposes of determining the default anti-skid efficiency value under CS 25.109(c)(2),
anti-skid systems have been grouped into three broad classifications; on/off, quasi-modulating and
fully modulating. These classifications represent evolving levels of technology and performance
capabilities on both dry and wet runways.
1.2 On/off systems are the simplest of the three types of anti-skid systems. For these systems,
fully metered brake pressure (as commanded by the pilot) is applied until wheel locking is sensed.
Brake pressure is then released to allow the wheel to spin back up. When the system senses that the
wheel is accelerating back to synchronous speed (i.e. ground speed), full metered pressure is again
applied. The cycle of full pressure application/complete pressure release is repeated throughout the
stop (or until the wheel ceases to skid with brake pressure applied).
1.4 Fully modulating systems are a further refinement of the quasi-modulating systems. The major
difference between these two types of anti-skid systems is in the implementation of the skid control
logic. During a skid, corrective action is based on the sensed wheel speed signal, rather than a pre-
programmed response. Specifically, the amount of pressure reduction or reapplication is based on the
rate at which the wheel is going into or recovering from a skid. Also, higher fidelity transducers and
upgraded control systems are used, which respond more quickly.
1.5 In addition to examining the control system differences noted above, a time history of the
response characteristics of the anti-skid system during a wet runway stop should be used to help
identify the type of anti-skid system. Comparing the response characteristics from wet and dry runway
stops can also be helpful.
Figure 1 shows an example of the response characteristics of a typical on-off system on both wet and
dry runways. In general, the on-off system exhibits a cyclic behaviour of brake pressure application
until a skid is sensed, followed by the complete release of brake pressure to allow the wheel to spin
back up. Full metered pressure (as commanded by the pilot) is then re-applied, starting the cycle over
again. The wheel speed trace exhibits deep and frequent skids (the troughs in the wheel speed trace),
and the average wheel speed is significantly less than the synchronous speed (which is represented
by the flat topped portions of the wheel speed trace). Note that the skids are deeper and more
frequent on a wet runway than on a dry runway. For the particular example shown in Figure 1, the
brake becomes torque-limited toward the end of the dry runway stop and is unable to generate enough
torque to cause further skidding.
2–B–8
BOOK 2 CS–25
2–B–9
CS–25 BOOK 2
2–B–10
BOOK 2 CS–25
When properly tuned, fully modulating systems are characterised by much smaller variations in brake
pressure around a fairly high average value. These systems can respond quickly to developing skids
and are capable of modulating brake pressure to reduce the frequency and depth of skidding. As a
result, the average wheel speed remains much closer to the synchronous wheel speed. Figure 3
illustrates an example of the response characteristics of a fully modulating system on dry and wet
runways.
2 Demonstration of anti-skid system operation when using the anti-skid efficiency values
specified in CS 25.109(c)(2)
2–B–11
CS–25 BOOK 2
2.1 If the applicant elects to use one of the anti-skid efficiency values specified in CS
25.109(c)(2), a limited amount of flight testing must still be conducted to verify that the anti-skid
system operates in a manner consistent with the type of anti-skid system declared by the applicant.
This testing should also demonstrate that the anti-skid system has been properly tuned for operation
on wet runways.
2.2 A minimum of one complete stop, or equivalent segmented stops, should be conducted on a
smooth (i.e. not grooved or porous friction course) wet runway at an appropriate speed and energy to
cover the critical operating mode of the anti-skid system. Since the objective of the test is to observe
the operation (i.e. cycling) of the anti-skid system, this test will normally be conducted at an energy
well below the maximum brake energy condition.
2.3 The section of the runway used for braking should be well soaked (i.e. not just damp), but not
flooded. The runway test section should be wet enough to result in a number of cycles of anti-skid
activity, but should not cause hydroplaning.
2.4 Before taxy and with cold tyres, the tyre pressure should be set to the highest value
appropriate to the take-off weight for which approval is being sought.
2.5 The tyres and brakes should not be new, but need not be in the fully worn condition. They
should be in a condition considered representative of typical in-service operations.
2.6 Sufficient data should be obtained to determine whether the system operates in a manner
consistent with the type of anti-skid system declared by the applicant, provide evidence that full brake
pressure is being applied upstream of the anti-skid valve during the flight test demonstration,
determine whether the anti-skid valve is performing as intended and show that the anti-skid system
has been properly tuned for a wet runway.
(ii) The hydraulic pressure at each brake (i.e. the hydraulic pressure downstream of the anti-skid
valve, or the electrical input to each anti-skid valve).
(iii) The hydraulic pressure at each brake metering valve (i.e. upstream of the anti-skid valve).
2.7 A qualitative assessment of the anti-skid system response and aeroplane controllability should
be made by the test pilot(s). In particular, pilot observations should confirm that:
(iii) The aeroplane tracks essentially straight, even though runway seams, water puddles and
wetter patches may not be uniformly distributed in location or extent.
3.1 If the applicant elects to derive the anti-skid system efficiency from flight test demonstrations,
sufficient flight testing, with adequate instrumentation, must be conducted to ensure confidence in the
value obtained. An anti-skid efficiency of 92% (i.e. a factor of 0·92) is considered to be the maximum
efficiency on a wet runway normally achievable with fully modulating digital anti-skid systems.
3.2 A minimum of three complete stops, or equivalent segmented stops, should be conducted on
a wet runway at appropriate speeds and energies to cover the critical operating modes of the anti-skid
system. Since the objective of the test is to determine the efficiency of the anti-skid system, these
tests will normally be conducted at energies well below the maximum brake energy condition. A
2–B–12
BOOK 2 CS–25
sufficient range of speeds should be covered to investigate any variation of the anti-skid efficiency with
speed.
3.3 The testing should be conducted on a smooth (i.e. not grooved or porous friction course)
runway.
3.4 The section of the runway used for braking should be well soaked (i.e. not just damp), but not
flooded. The runway test section should be wet enough to result in a number of cycles of anti-skid
activity, but should not cause hydroplaning.
3.5 Before taxy and with cold tyres, the tyre pressure should be set to the highest value
appropriate to the take-off weight for which approval is being sought.
3.6 The tyres and brake should not be new, but need not be in the fully worn condition. They
should be in a condition considered representative of typical in-service operations.
3.7 A qualitative assessment of anti-skid system response and aeroplane controllability should be
made by the test pilot(s). In particular, pilot observations should confirm that:
(ii) The aeroplane tracks essentially straight, even though runway seams, water puddles and
wetter patches may not be uniformly distributed in location or extent.
3.8 The wet runway anti-skid efficiency value should be determined as described in Paragraph 4
of this AMC. The test instrumentation and data collection should be consistent with the method used.
4.1 Paragraph 3 above provides guidance on the flight testing required to support the
determination of a specific anti-skid system efficiency value. The following paragraphs describe 2
methods of calculating an efficiency value from the data recorded. These two methods, which yield
equivalent results, are referred to as the torque method and the wheel slip method. Other methods
may also be acceptable if they can be shown to give equivalent results.
Under the torque method, the anti-skid system efficiency is determined by comparing the energy
absorbed by the brake during an actual wet runway stop to the energy that is determined by
integrating, over the stopping distance, a curve defined by connecting the peaks of the instantaneous
brake force curve (see figure 4). The energy absorbed by the brake during the actual wet runway stop
is determined by integrating the curve of instantaneous brake force over the stopping distance.
2–B–13
CS–25 BOOK 2
(Tb + αI )
Fb =
Rtyre
where:
Fb = brake force
Tb = brake torque
α = wheel acceleration
For brake installations where measuring brake torque directly is impractical, torque may be determined
from other parameters (e.g. brake pressure) if a suitable correlation is available. Wheel acceleration is
obtained from the first derivative of wheel speed. Instrumentation recording rates and data analysis
techniques for wheel speed and torque data should be well matched to the anti-skid response
characteristics to avoid introducing noise and other artifacts of the instrumentation system into the
data.
Since the derivative of wheel speed is used in calculating brake force, smoothing of the wheel speed
data is usually necessary to give good results. The smoothing algorithm should be carefully designed
as it can affect the resulting efficiency calculation. Filtering or smoothing of the brake torque or brake
force data should not normally be done. If conditioning is applied, it should be done in a conservative
manner (i.e. result in a lower efficiency value) and should not misrepresent actual aeroplane/system
dynamics.
Both the instantaneous brake force and the peak brake force should be integrated over the stopping
distance. The anti-skid efficiency value for determining the wet runway accelerate-stop distance is the
ratio of the instantaneous brake force integral to the peak brake force integral:
η =
∫ instantaneous brake force. ds
∫ peak brake force.ds
where:
s = stopping distance
The stopping distance is defined as the distance travelled during the specific wet runway stopping
demonstration, beginning when the full braking configuration is obtained and ending at the lowest
speed at which anti-skid cycling occurs (i.e. the brakes are not torque limited), except that this speed
need not be less than 19 km/h (10 kt). Any variation in the anti-skid efficiency with speed should also
be investigated, which can be accomplished by determining the efficiency over segments of the total
stopping distance. If significant variations are noted, this variation should be reflected in the braking
force used to determine the accelerate-stop distances (either by using a variable efficiency or by using
a conservative single value).
At brake application, the tyre begins to slip with respect to the runway surface, i.e. the wheel speed
slows down with respect to the aeroplane’s ground speed. As the amount of tyre slip increases, the
2–B–14
BOOK 2 CS–25
brake force also increases until an optimal slip is reached. If the amount of slip continues to increase
past the optimal slip, the braking force will decrease.
Using the wheel slip method, the anti-skid efficiency is determined by comparing the actual wheel slip
measured during a wet runway stop to the optimal slip. Since the wheel slip varies significantly during
the stop, sufficient wheel and ground speed data must be obtained to determine the variation of both
the actual wheel slip and the optimal wheel slip over the length of the stop. A sampling rate of at least
16 samples per second for both wheel speed and ground speed has been found to yield acceptable
fidelity.
For each wheel and ground speed data point, the instantaneous anti-skid efficiency value should be
determined from the relationship shown in Figure 5:
3
WSR WSR
for WSR < OPS ηi = 1.5 – 0.5
OPS OPS
1 − WSR
ηi = 0.5 1 +
1 − OPS
for WSR < OPS
where:
wheel speed
WSR = wheel slip ratio = 1 –
ground speed
OPS = optimal slip ratio; and
To determine the overall anti-skid efficiency value for use in calculating the wet runway accelerate-
stop distance, the instantaneous anti-skid efficiencies should be integrated with respect to distance
and divided by the total stopping distance:
η =
∫ η . ds
i
s
where:
s = stopping distance
2–B–15
CS–25 BOOK 2
The stopping distance is defined as the distance travelled during the specific wet runway stopping
demonstration, beginning when the full braking configuration is obtained and ending at the lowest
speed at which anti-skid cycling occurs (i.e. the brakes are not torque limited), except that this speed
need not be less than 19 km/h (10 kt). Any variation in the anti-skid efficiency with speed should also
be investigated, which can be accomplished by determining the efficiency over segments of the total
stopping distance. If significant variations are noted, this variation should be reflected in the braking
force used to determine the accelerate-stop distances (either by using a variable efficiency or by using
a conservative single value).
The applicant should provide substantiation of the optimal wheel slip value(s) used to determine the
anti-skid efficiency value. An acceptable method for determining the optimal slip value(s) is to
compare time history plots of the brake force and wheel slip data obtained during the wet runway
stopping tests. For brake installations where measuring brake force directly is impractical, brake force
may be determined from other parameters (e.g. brake pressure) if a suitable correlation is available.
For those skids where wheel slip continues to increase after a reduction in the brake force, the optimal
slip is the value corresponding to the brake force peak. See Figure 6 for an example and note how
both the actual wheel slip and the optimal wheel slip can vary during the stop.
4.4 For dispatch with an inoperative anti-skid system (if approved), the wet runway accelerate-
stop distances should be based on an efficiency no higher than that allowed by CS 25.109(c)(2) for an
on-off type of anti-skid system. The safety of this type of operation should be demonstrated by flight
tests conducted in accordance with Paragraph 2 of this AMC.
In addition to taking into account the efficiency of the anti-skid system, CS 25.109(b)(2)(ii) also
requires adjusting the braking force for the effect of the distribution of the normal load between braked
and unbraked wheels at the most adverse centre of gravity position approved for take-off. The
stopping force due to braking is equal to the braking coefficient multiplied by the normal load (i.e.
weight) on each braked wheel. The portion of the aeroplane’s weight being supported by the unbraked
wheels (e.g. unbraked nose wheels) does not contribute to the stopping force generated by the
brakes. This effect must be taken into account for the most adverse centre of gravity position
approved for take-off, considering any centre of gravity shifts that occur due to the dynamics of the
stop. The most adverse centre of gravity position is the position that results in the least load on the
braked wheels.
2–B–16
BOOK 2 CS–25
AMC 25.109(d)(2)
Accelerate-stop distance: anti-skid efficiency on grooved and porous friction course (PFC)
runways.
Properly designed, constructed and maintained grooved and PFC runways can offer significant
improvements in wet runway braking capability. A conservative level of performance credit is provided
by CS 25.109(d) to reflect this performance improvement and to provide an incentive for installing and
maintaining such surfaces.
In accordance with CS 25.105(c) and 25.109(d), applicants may optionally determine the accelerate-
stop distance applicable to wet grooved and PFC runways. These data would be included in the AFM
in addition to the smooth runway accelerate-stop distance data. The braking coefficient for determining
the accelerate-stop distance on grooved and PFC runways is defined in CS 25.109(d) as either 70% of
the braking coefficient used to determine the dry runway accelerate-stop distances, or a curve based
on ESDU 71026 data and derived in a manner consistent with that used for smooth runways. In either
case, the brake torque limitations determined on a dry runway may not be exceeded.
Using a simple factor applied to the dry runway braking coefficient is acceptable for grooved and PFC
runways because the braking coefficient’s variation with speed is much lower on these types of
runways. On smooth wet runways, the braking coefficient varies significantly with speed, which makes
it inappropriate to apply a simple factor to the dry runway braking coefficient. For applicants who
choose to determine the grooved/PFC wet runway accelerate-stop distances in a manner consistent
with that used for smooth runways, CS 25.109(d)(2) provides the maximum tyre-to-ground braking
coefficient applicable to grooved and PFC runways. This maximum tyre-to-ground braking coefficient
must be adjusted for the anti-skid system efficiency, either by using the value specified in CS
25.109(c)(2) appropriate to the type of anti-skid system installed, or by using a specific efficiency
established by the applicant. As anti-skid system performance depends on the characteristics of the
runway surface, a system that has been tuned for optimum performance on a smooth surface may not
achieve the same level of efficiency on a grooved or porous friction course runway, and vice versa.
Consequently, if the applicant elects to establish a specific efficiency for use with grooved or PFC
surfaces, anti-skid efficiency testing should be conducted on a wet runway with such a surface, in
addition to testing on a smooth runway. Means other than flight testing may be acceptable, such as
using the efficiency previously determined for smooth wet runways, if that efficiency is shown to be
representative of, or conservative for, grooved and PFC runways. The resulting braking force for
grooved/PFC wet runways must be adjusted for the effect of the distribution of the normal load
between braked and unbraked wheels. This adjustment will be similar to that used for determining the
braking force for smooth runways, except that the braking dynamics should be appropriate to the
braking force achieved on grooved and PFC wet runways. Due to the increased braking force on
grooved and PFC wet runways, an increased download on the nose wheel and corresponding
reduction in the download on the main gear is expected.
AMC 25.109(f)
Accelerate-stop distance: credit for reverse thrust.
In accordance with CS 25.109(f), reverse thrust may not be used to determine the accelerate-stop
distances for a dry runway. For wet runway accelerate-stop distances, however, CS 25.109(f) allows
credit for the stopping force provided by reverse thrust, if the requirements of CS 25.109(e) are met. In
addition, the procedures associated with the use of reverse thrust, which CS 25.101(f) requires the
applicant to provide, must meet the requirements of CS 25.101(h). The following criteria provide
acceptable means of demonstrating compliance with these requirements:
1 Procedures for using reverse thrust during a rejected take-off must be developed and
demonstrated. These procedures should include all of the pilot actions necessary to obtain the
recommended level of reverse thrust, maintain directional control and safe engine operating
characteristics, and return the reverser(s), as applicable, to either the idle or the stowed position.
These procedures need not be the same as those recommended for use during a landing stop, but
2–B–17
CS–25 BOOK 2
must not result in additional hazards, (e.g., cause a flame out or any adverse engine operating
characteristics), nor may they significantly increase flightcrew workload or training needs.
2 It should be demonstrated that using reverse thrust during a rejected take-off complies with
the engine operating characteristics requirements of CS 25.939(a). No adverse engine operating
characteristics should be exhibited. The reverse thrust procedures may specify a speed at which the
reverse thrust is to be reduced to idle in order to maintain safe engine operating characteristics.
3 The time sequence for the actions necessary to obtain the recommended level of reverse
thrust should be demonstrated by flight test. The time sequence used to determine the accelerate-stop
distances should reflect the most critical case relative to the time needed to deploy the thrust
reversers. For example, on some aeroplanes the outboard thrust reversers are locked out if an
outboard engine fails. This safety feature prevents the pilot from applying asymmetric reverse thrust
on the outboard engines, but it may also delay the pilot’s selection of reverse thrust on the operable
reversers. In addition, if the selection of reverse thrust is the fourth or subsequent pilot action to stop
the aeroplane (e.g., after manual brake application, thrust/power reduction, and spoiler deployment), a
one second delay should be added to the demonstrated time to select reverse thrust. (See figure 1 of
AMC 25.101(h)(3).)
4 The response times of the affected aeroplane systems to pilot inputs should be taken into
account. For example, delays in system operation, such as thrust reverser interlocks that prevent the
pilot from applying reverse thrust until the reverser is deployed, should be taken into account. The
effects of transient response characteristics, such as reverse thrust engine spin-up, should also be
included.
5 To enable a pilot of average skill to consistently obtain the recommended level of reverse
thrust under typical in-service conditions, a lever position that incorporates tactile feedback (e.g., a
detent or stop) should be provided. If tactile feedback is not provided, a conservative level of reverse
thrust should be assumed.
6 The applicant should demonstrate that exceptional skill is not required to maintain directional
control on a wet runway with a 19 km/h (ten knot) crosswind from the most adverse direction. For
demonstration purposes, a wet runway may be simulated by using a castering nosewheel on a dry
runway. Symmetric braking should be used during the demonstration, and both all-engines-operating
and critical-engine-inoperative reverse thrust should be considered. The brakes and thrust reversers
may not be modulated to maintain directional control. The reverse thrust procedures may specify a
speed at which the reverse thrust is reduced to idle in order to maintain directional controllability.
8 The number of thrust reversers used to determine the wet runway accelerate-stop distance
data provided in the AFM should reflect the number of engines assumed to be operating during the
rejected take-off along with any applicable system design features. The all-engines-operating
accelerate-stop distances should be based on all thrust reversers operating. The one-engine-
inoperative accelerate-stop distances should be based on failure of the critical engine. For example, if
the outboard thrust reversers are locked out when an outboard engine fails, the one-engine-
inoperative accelerate stop distances can only include reverse thrust from the inboard engine thrust
reversers.
9 For the engine failure case, it should be assumed that the thrust reverser does not deploy
(i.e., no reverse thrust or drag credit for deployed thrust reverser buckets on the failed engine).
10 For approval of dispatch with one or more inoperative thrust reverser(s), the associated
performance information should be provided either in the Aeroplane Flight Manual or the Master
Minimum Equipment List.
2–B–18
BOOK 2 CS–25
11 The effective stopping force provided by reverse thrust in each, or at the option of the
applicant, the most critical take-off configuration, should be demonstrated by flight test. Flight test
demonstrations should be conducted to substantiate the accelerate-stop distances, and should include
the combined use of all the approved means for stopping the aeroplane. These demonstrations may
be conducted on a dry runway.
AMC 25.111
Take-off Path
AMC 25.111(b)
Take-off Path
1 Rotation speed, VR, is intended to be the speed at which the pilot initiates action to raise the
nose gear off the ground, during the acceleration to V2; consequently, the take-off path determination,
in accordance with CS 25.111 (a) and (b), should assume that pilot action to raise the nose gear off
the ground will not be initiated until the speed VR has been reached.
2 The time between lift-off and the initiation of gear retraction during take-off distance
demonstrations should not be less than that necessary to establish an indicated positive rate of climb
plus one second. For the purposes of flight manual expansion, the average demonstrated time delay
between lift-off and initiation of gear retraction may be assumed; however, this value should not be
less than 3 seconds.
In establishment of the take-off distance and take-off run, with all engines operating, in accordance
with CS 25.113(a), (b) and (c), the flight technique should be such that –
a. A speed of not less than V2 is achieved before reaching a height of 11 m (35 ft) above the
take-off surface,
b. It is consistent with the achievement of a smooth transition to a steady initial climb speed of
not less than V2 + 19 km/h (10 kt) at a height of 122 m (400 ft) above the take-off surface.
2–B–19
CS–25 BOOK 2
AMC 25.119(a)
Landing Climb: All-engines-operating
a. Engine acceleration tests should be conducted using the most critical combination of the
following parameters:
i. Altitude;
ii. Airspeed;
likely to be encountered during an approach to a landing airfield within the altitude range for which
landing certification is sought; or
AMC 25.121
Climb: One-engine-inoperative
AMC 25.121(a)
Climb: One-engine-inoperative
The configuration of the landing gear used in showing compliance with the climb requirements of CS
25.121(a) may be that finally achieved following ‘gear down’ selection.
AMC 25.121(a)(1)
Climb: One-engine-inoperative
A ‘power operating condition’ more critical than that existing at the time when retraction of the landing
gear is begun would occur, for example, if water injection were discontinued prior to reaching the point
at which the landing gear is fully retracted.
AMC 25.121(b)(1)
Climb: One-engine-inoperative
A ‘power operating condition’ more critical than that existing at the time the landing gear is fully
retracted would occur, for example, if water injection were discontinued prior to reaching a gross
height of 122 m (400 ft).
AMC 25.123
En-route Flight Paths
If, in showing compliance with CS 25.123, any credit is to be taken for the progressive use of fuel by
the operating engines, the fuel flow rate should be assumed to be 80% of the engine specification flow
2–B–20
BOOK 2 CS–25
rate at maximum continuous power, unless a more appropriate figure has been substantiated by flight
tests.
AMC 25.125(a)(3)
Change of Configuration
No changes in configuration, addition of thrust, or nose depression should be made after reaching 15
m (50 ft) height.
AMC 25.125(b)
Landing
1 During measured landings, if the brakes can be consistently applied in a manner permitting
the nose gear to touch down safely, the brakes may be applied with only the main wheels firmly on the
ground. Otherwise, the brakes should not be applied until all wheels are firmly on the ground.
2 This is not intended to prevent operation in the normal way of automatic braking systems
which, for instance, permit brakes to be selected on before touchdown.
AMC 25.125(b)(2)
Landing
To ensure compliance with CS 25.125(b)(2), a series of six measured landings should be conducted
on the same set of wheel brakes and tyres.
In showing compliance with the requirements of CS 25.143(a) and (b) account should be taken of
aeroelastic effects and structural dynamics (including aeroplane response to rough runways and water
waves) which may influence the aeroplane handling qualities in flight and on the surface. The
oscillation characteristics of the flightdeck, in likely atmospheric conditions, should be such that there
is no reduction in ability to control and manoeuvre the aeroplane safely.
2–B–21
CS–25 BOOK 2
AMC 25.143(b)(1)
Control Following Engine Failure
a. At each take-off flap setting at the lowest speed recommended for initial steady climb with all
engines operating after take-off, with –
i. All engines, prior to the critical engine becoming inoperative, at maximum take-off power or
thrust;
i. All engines, prior to the critical engine becoming inoperative, at maximum continuous power or
thrust;
2 The demonstrations should be made with simulated engine failure occurring during straight
flight with wings level. In order to allow for likely delay in the initiation of recovery action, no action to
recover the aeroplane should be taken for 2 seconds following engine failure. The recovery action
should not necessitate movement of the engine, propeller or trimming controls, nor require excessive
control forces. The aeroplane will be considered to have reached an unacceptable attitude if a bank
angle of 45° is exceeded during recovery.
1 The maximum forces given in the table in CS 25.143(c) for pitch and roll control for short term
application are applicable to manoeuvres in which the control force is only needed for a short period.
Where the manoeuvre is such that the pilot will need to use one hand to operate other controls (such
as the landing flare or go-around, or during changes of configuration or power resulting in a change of
control force that must be trimmed out) the single-handed maximum control forces will be applicable.
In other cases (such as take-off rotation, or manoeuvring during en-route flight) the two handed
maximum forces will apply.
Short term forces are the initial stabilised control forces that result from maintaining the intended flight
path during configuration changes and normal transitions from one flight condition to another, or from
regaining control following a failure. It is assumed that the pilot will take immediate action to reduce or
eliminate such forces by re-trimming or changing configuration or flight conditions, and consequently
short term forces are not considered to exist for any significant duration. They do not
2–B–22
BOOK 2 CS–25
include transient force peaks that may occur during the configuration change, change of flight
condition or recovery of control following a failure.
Long term forces are those control forces that result from normal or failure conditions that cannot
readily be trimmed out or eliminated.
An acceptable means of compliance with the requirement that stick forces may not be excessive when
manoeuvring the aeroplane, is to demonstrate that, in a turn for 0·5g incremental normal
acceleration (0·3g above 6096 m (20 000 ft)) at speeds up to VFC/MFC, the average stick force gradient
does not exceed 534 N (120 lbf)/g.
1 The objective of CS 25.143(f) is to ensure that the limit strength of any critical component on
the aeroplane would not be exceeded in manoeuvring flight. In much of the structure the load
sustained in manoeuvring flight can be assumed to be directly proportional to the load factor applied.
However, this may not be the case for some parts of the structure, e.g., the tail and rear fuselage.
Nevertheless, it is accepted that the aeroplane load factor will be a sufficient guide to the possibility of
exceeding limit strength on any critical component if a structural investigation is undertaken whenever
the design positive limit manoeuvring load factor is closely approached. If flight testing indicates that
the design positive limit manoeuvring load factor could be exceeded in steady manoeuvring flight with
a 222 N (50 lbf) stick force, the aeroplane structure should be evaluated for the anticipated load at a
222 N (50 lbf) stick force. The aeroplane will be considered to have been overstressed if limit strength
has been exceeded in any critical component. For the purposes of this evaluation, limit strength is
defined as the larger of either the limit design loads envelope increased by the available margins of
safety, or the ultimate static test strength divided by 1·5.
2.1 A stick force of at least 222 N (50 lbf) to reach limit strength in steady manoeuvres or wind up
turns is considered acceptable to demonstrate adequate minimum force at limit strength in the
absence of deterrent buffeting. If heavy buffeting occurs before the limit strength condition is reached,
a somewhat lower stick force at limit strength may be acceptable. The acceptability of a stick force of
less than 222 N (50 lbf) at the limit strength condition will depend upon the intensity of the buffet, the
adequacy of the warning margin (i.e., the load factor increment between the heavy buffet and the limit
strength condition) and the stick force characteristics. In determining the limit strength condition for
each critical component, the contribution of buffet loads to the overall manoeuvring loads should be
taken into account.
2.2 This minimum stick force applies in the en-route configuration with the aeroplane trimmed for
straight flight, at all speeds above the minimum speed at which the limit strength condition can be
achieved without stalling. No minimum stick force is specified for other configurations, but the
requirements of CS 25.143 (f) are applicable in these conditions.
3.1 At all points within the buffet onset boundary determined in accordance with CS 25.251(e), but
not including speeds above VFC/MFC, the stick force should increase progressively with increasing load
factor. Any reduction in stick force gradient with change of load factor should not be so large or abrupt
as to impair significantly the ability of the pilot to maintain control over the load factor and pitch
attitude of the aeroplane.
2–B–23
CS–25 BOOK 2
3.2 Beyond the buffet onset boundary, hazardous stick force characteristics should not be
encountered within the permitted manoeuvring envelope as limited by paragraph 3.3. It should be
possible, by use of the primary longitudinal control alone, to pitch the aeroplane rapidly nose down so
as to regain the initial trimmed conditions. The stick force characteristics demonstrated should comply
with the following:
a. For normal acceleration increments of up to 0·3 g beyond buffet onset, where these can be
achieved, local reversal of the stick force gradient may be acceptable provided that any tendency to
pitch up is mild and easily controllable.
b. For normal acceleration increments of more than 0·3 g beyond buffet onset, where these can
be achieved, more marked reversals of the stick force gradient may be acceptable. It should be
possible for any tendency to pitch up to be contained within the allowable manoeuvring limits without
applying push forces to the control column and without making a large and rapid forward movement of
the control column.
3.3 In flight tests to satisfy paragraph 3.1 and 3.2 the load factor should be increased until either –
a. The level of buffet becomes sufficient to provide a strong and effective deterrent to further
increase of load factor; or
b. Further increase of load factor requires a stick force in excess of 667 N (150 lbf) (or in excess
of 445 N (100 lbf) when beyond the buffet onset boundary) or is impossible because of the limitations
of the control system; or
c. The positive limit manoeuvring load factor established in compliance with CS 25.337(b) is
achieved.
It is not intended that a detailed flight test assessment of the manoeuvring characteristics under
negative load factors should necessarily be made throughout the specified range of conditions. An
assessment of the characteristics in the normal flight envelope involving normal accelerations from 1 g
to 0 g will normally be sufficient. Stick forces should also be assessed during other required flight
testing involving negative load factors. Where these assessments reveal stick force gradients that are
unusually low, or that are subject to significant variation, a more detailed assessment, in the most
critical of the specified conditions, will be required. This may be based on calculations provided these
are supported by adequate flight test or wind tunnel data.
AMC 25.143(g)
Manoeuvre Capability
where VSW is the stall warning speed determined at idle power and at 1g in the same conditions of
configuration, weight and centre of gravity, all expressed in CAS. Neverthless, a limited number of
turning flight manoeuvres should be conducted to confirm qualitatively that the aeroplane does meet
2–B–24
BOOK 2 CS–25
the manoeuvre bank angle objectives (e.g. for an aeroplane with a significant Mach effect on the CL/α
relationship) and does not exhibit other characteristics which might interfere with normal manoeuvring.
2 The effect of thrust or power is normally a function of thrust to weight ratio alone and,
therefore, it is acceptable for flight test purposes to use the thrust or power setting that is consistent
with a WAT-limited climb gradient at the test conditions of weight, altitude and temperature. However,
if the manoeuvre margin to stall warning (or other relevant characteristic that might interfere with
normal manoeuvring) is reduced with increasing thrust or power, the critical conditions of both thrust
or power and thrust-to-weight ratio must be taken into account when demonstrating the required
manoeuvring capabilities.
AMC 25.145(a)
Longitudinal Control – Control Near The Stall
1 CS 25.145(a) requires that there be adequate longitudinal control to promptly pitch the
aeroplane nose down from at or near the stall to return to the original trim speed. The intent is to
ensure sufficient pitch control for a prompt recovery if the aeroplane is inadvertently slowed to the
point of the stall. Although this requirement must be met with power off and at maximum continuous
power, there is no intention to require stall demonstrations at engine powers above that specified in
CS 25.201(a)(2). Instead of performing a full stall at maximum continuous power, compliance may be
assessed by demonstrating sufficient static longitudinal stability and nose down control margin when
the deceleration is ended at least one second past stall warning during a 0.5 m/s2 (one knot per
second) deceleration. The static longitudinal stability during the manoeuvre and the nose down control
power remaining at the end of the manoeuvre must be sufficient to assure compliance with the
requirement.
2 The aeroplane should be trimmed at the speed for each configuration as prescribed in CS
25.103(b)(6). The aeroplane should then be decelerated at 0.5 m/s 2 (1 knot per second) with wings
level. For tests at idle power, it should be demonstrated that the nose can be pitched down from any
speed between the trim speed and the stall. Typically, the most critical point is at the stall when in stall
buffet. The rate of speed increase during the recovery should be adequate to promptly return to the
trim point. Data from the stall characteristics test can be used to evaluate this capability at the stall.
For tests at maximum continuous power, the manoeuvre need not be continued for more than one
second beyond the onset of stall warning. However, the static longitudinal stability characteristics
during the manoeuvre and the nose down control power remaining at the end of the manoeuvre must
be sufficient to assure that a prompt recovery to the trim speed could be attained if the aeroplane is
slowed to the point of stall.
Where high lift devices are being retracted and where large and rapid changes in maximum lift occur
as a result of movement of high-lift devices, some reduction in the margin above the stall may be
accepted.
The presence of gated positions on the flap control does not affect the requirement to demonstrate full
flap extensions and retractions without changing the trim control.
2–B–25
CS–25 BOOK 2
AMC 25.145(e)
Longitudinal Control
If gates are provided, CS 25.145(e) requires the first gate from the maximum landing position to be
located at a position corresponding to a go-around configuration. If there are multiple go-around
configurations, the following criteria should be considered when selecting the location of the gate:
c. The potential for the pilot to select the incorrect control position, considering the likely
situations for use of the different go-around positions.
d. The extent to which the gate(s) aid the pilot in quickly and accurately selecting the correct
position of the high-lift devices.
AMC 25.147(a)
Directional Control; general
The intention of the requirement is that the aircraft can be yawed as prescribed without the need for
application of bank angle. Small variations of bank angle that are inevitable in a realistic flight test
demonstration are acceptable.
With the aeroplane in trim, all as nearly as possible,in trim, for straight flight at V2, establish a steady
30° banked turn. It should be demonstrated that the aeroplane can be rolled to a 30° bank angle in the
other direction in not more than 11 seconds. In this demonstration, the rudder may be used to the
extent necessary to minimise sideslip. The demonstration should be made in the most adverse
direction. The manoeuvre may be unchecked. Care should be taken to prevent excessive sideslip and
bank angle during the recovery.
The inoperative engine that would be most critical for controllability, with the propeller
(if applicable) feathered.
2–B–26
BOOK 2 CS–25
AMC 25.147(f)
Lateral Control: All Engines Operating
An acceptable method of demonstrating that roll response and peak roll rates are adequate for
compliance with CS 25.147 (f) is as follows:
It should be possible in the conditions specified below to roll the aeroplane from a steady 30° banked
turn through an angle of 60° so as to reverse the direction of the turn in not more than 7 seconds. In
these demonstrations the rudder may be used to the extent necessary to minimise sideslip. The
demonstrations should be made rolling the aeroplane in either direction, and the manoeuvres may be
unchecked.
Conditions:
(a) En-route: Airspeed. All speeds between the minimum value of the scheduled all-engines-
operating climb speed and VMO/MMO .
Power. All engines operating at all powers from flight idle up to maximum continuous
power.
Trim. The aeroplane should be in trim from straight flight in these conditions, and the
trimming controls should not be moved during the manoeuvre.
(b) Approach: Airspeed. Either the speed maintained down to the 15 m (50 ft) height in compliance
with CS 25.125(a)(2), or the target threshold speed determined in accordance with CS
25.125 (c)(2)(i) as appropriate to the method of landing distance determination used.
Power. All engines operating at the power required to give a gradient of descent of
5·0%.
Trim. The aeroplane should be in trim for straight flight in these conditions, and the
trimming controls should not be moved during the manoeuvre.
AMC 25.149
Minimum Control Speeds
1 The determination of the minimum control speed, VMC, and the variation of VMC with available
thrust, may be made primarily by means of ‘static’ testing, in which the speed of the aeroplane is
slowly reduced, with the thrust asymmetry already established, until the speed is reached at which
straight flight can no longer be maintained. A small number of ‘dynamic’ tests, in which sudden failure
of the critical engine is simulated, should be made in order to check that the VMCs determined by the
static method are valid.
2 When minimum control speed data are expanded for the determination of minimum control
speeds (including VMC, VMCG and VMCL) for all ambient conditions, these speeds should be based on
the maximum values of thrust which can reasonably be expected from a production engine in service.
2–B–27
CS–25 BOOK 2
The minimum control speeds should not be based on specification thrust, since this thrust represents
the minimum thrust as guaranteed by the manufacturer, and the resulting speeds would be
unconservative for most cases.
AMC 25.149(e)
Minimum Control Speed
a. The pilot feeling a distinct change in the directional tracking characteristics of the aeroplane,
or
b. The pilot seeing a directional divergence of the aeroplane with respect to the view outside the
aeroplane.
AMC 25.149(f)
Minimum Control Speeds
1 At the option of the applicant, a one-engine-inoperative landing minimum control speed, VMCL
(1 out) may be determined in the conditions appropriate to an approach and landing with one engine
having failed before the start of the approach. In this case, only those configurations recommended
for use during an approach and landing with one engine inoperative need be considered. The
propeller of the inoperative engine, if applicable, may be feathered throughout.
2 The resulting value of VMCL (1 out) may be used in determining the recommended procedures
and speeds for a one-engine-inoperative approach and landing.
AMC 25.149(g)
Minimum Control Speeds
1 At the option of the applicant, a two-engine-inoperative landing minimum control speed, VMCL-2
(2 out) may be determined in the conditions appropriate to an approach and landing with two engines
having failed before the start of the approach. In this case, only those configurations recommended
for use during an approach and landing with two engines inoperative need be considered. The
propellers of the inoperative engines, if applicable, may be feathered throughout.
2 The values of VMCL-2 or VMCL-2 (2 out) should be used as guidance in determining the
recommended procedures and speeds for a two-engines-inoperative approach and landing.
AMC 25.149(h)(3)
Minimum Control Speeds
The 20° lateral control demonstration manoeuvre may be flown as a bank-to-bank roll through wings
level.
AMC 25.149(h)(4)
Minimum Control Speeds
Where an autofeather or other drag limiting system is installed and will be operative at approach
power settings, its operation may be assumed in determining the propeller position achieved when the
engine fails. Where automatic feathering is not available the effects of subsequent movements of the
engine and propeller controls should be considered, including fully closing the power lever of the failed
engine in conjunction with maintaining the go-around power setting on the operating engine(s).
2–B–28
BOOK 2 CS–25
AMC 25.173(c)
Static Longitudinal Stability
The average gradient is taken over each half of the speed range between 0·85 and 1·15 V trim.
AMC 25.177(c)
Steady, Straight Sideslips
1 CS 25.177(c) requires, in steady, straight sideslips throughout the range of sideslip angles
appropriate to the operation of the aeroplane, but not less than those obtained with one half of the
available rudder control input (e.g., rudder pedal input) or a rudder control force of 801 N (180 lbf) ,
that the aileron and rudder control movements and forces be proportional to the angle of sideslip.
Also, the factor of proportionality must lie between limits found necessary for safe operation.
CS 25.177(c) states, by cross-reference to CS 25.177(a), that these steady, straight sideslip criteria
must be met for all landing gear and flap positions and symmetrical power conditions at speeds from
1.13 VSR1 to VFE, VLE, or VFC/MFC, as appropriate for the configuration.
2.1 Experience has shown that an acceptable method for determining the appropriate sideslip angle
for the operation of a transport category aeroplane is provided by the following equation:
Recognising that smaller sideslip angles are appropriate as speed is increased, this equation provides
sideslip angle as a function of airspeed. The equation is based on the theoretical sideslip value for a
56 km/h (30-knot) crosswind, but has been shown to conservatively represent (i.e., exceed) the
sideslip angles achieved in maximum crosswind take-offs and landings and minimum static and
dynamic control speed testing for a variety of transport category aeroplanes. Experience has also
shown that a maximum sideslip angle of 15 degrees is generally appropriate for most transport
category aeroplanes even though the equation may provide a higher sideslip angle. However, limiting
the maximum sideslip angle to 15 degrees may not be appropriate for aeroplanes with low approach
speeds or high crosswind capability.
2.2 A lower sideslip angle than that provided in paragraph 2.1 may be used if it is substantiated that
the lower value conservatively covers all crosswind conditions, engine failure scenarios, and other
conditions where sideslip may be experienced within the approved operating envelope. Conversely, a
higher value should be used for aeroplanes where test evidence indicates that a higher value would
be appropriate to the operation of the aeroplane.
3 For the purposes of showing compliance with the requirement out to sideslip angles associated
with one-half of the available rudder control input, there is no need to consider a rudder control input
beyond that corresponding to full available rudder surface travel or a rudder control force of 801 N
(180 lbf) . Some rudder control system designs may limit the available rudder surface deflection such
that full deflection for the particular flight condition is reached before the rudder control reaches one-
half of its available travel. In such cases, further rudder control input would not result in additional
rudder surface deflection.
4.1 Steady, straight sideslips should be conducted in each direction to show that the aileron and
rudder control movements and forces are substantially proportional to the angle of sideslip in a stable
2–B–29
CS–25 BOOK 2
sense, and that the factor of proportionality is within the limits found necessary for safe operation.
These tests should be conducted at progressively greater sideslip angles up to the sideslip angle
appropriate to the operation of the aeroplane (see paragraph 2.1) or the sideslip angle associated
with one-half of the available rudder control input, whichever is greater.
4.2 When determining the rudder and aileron control forces, the controls should be relaxed at each
point to find the minimum force needed to maintain the control surface deflection. If excessive friction
is present, the resulting low forces will indicate the aeroplane does not have acceptable stability
characteristics.
4.3 In lieu of conducting each of the separate qualitative tests required by CS 25.177(a) and (b), the
applicant may use recorded quantitative data showing aileron and rudder control force and position
versus sideslip (left and right) to the appropriate limits in the steady heading sideslips conducted to
show compliance with CS 25.177(c). If the control force and position versus sideslip indicates
positive dihedral effect and positive directional stability, compliance with CS 25.177(a) and (b) will
have been successfully demonstrated."
AMC 25.177(d)
Full Rudder Sideslips
1.1 At sideslip angles greater than those appropriate for normal operation of the aeroplane, up to the
sideslip angle at which full rudder control is used or a rudder control force of 801 N (180 lbf) is obtained,
CS 25.177(d) requires that the rudder control forces may not reverse and increased rudder deflection must
be needed for increased angles of sideslip. The goals of this higher-than-normal sideslip angle test are to
show that at full rudder, or at maximum expected pilot effort: (1) the rudder control force does not reverse,
and (2) increased rudder deflection must be needed for increased angles of sideslip, thus demonstrating
freedom from rudder lock or fin stall, and adequate directional stability for manoeuvres involving large
rudder inputs.
1.2 Compliance with this requirement should be shown using straight, steady sideslips. However, if full
lateral control input is reached before full rudder control travel or a rudder control force of 801 N (180 lbf) is
reached, the manoeuvre may be continued in a non-steady heading (i.e., rolling and yawing) manoeuvre.
Care should be taken to prevent excessive bank angles that may occur during this manoeuvre.
1.3 CS 25.177(d) states that the criteria listed in paragraph 1.1 must be met at all approved landing gear
and flap positions for the range of operating speeds and power conditions appropriate to each landing gear
and flap position with all engines operating. The range of operating speeds and power conditions
appropriate to each landing gear and flap position with all engines operating should be consistent with the
following:
a. For take-off configurations, speeds from V2+xx (airspeed approved for all-engines-operating initial climb)
to VFE or VLE, as appropriate, and take-off power/thrust;
b. For flaps up configurations, speeds from 1.23 VSR to VLE or VMO/MMO, as appropriate, and power from
idle to maximum continuous power/thrust;
c. For approach configurations, speeds from 1.23 VSR to VFE or VLE, as appropriate, and power from idle to
go-around power/thrust; and
d. For landing configurations, speeds from VREF-9.3 km/h (5 knots) to VFE or VLE, as appropriate, with
power from idle to go-around power/thrust at speeds from VREF to VFE/VLE, and idle power at VREF-9.3 km/h
(5 knots) (to cover the landing flare).
2.1 Rudder lock is that condition where the rudder over-balances aerodynamically and either deflects fully
with no additional pilot input or does not tend to return to neutral when the pilot input is released. It is
2–B–30
BOOK 2 CS–25
indicated by a reversal in the rudder control force as sideslip angle is increased. Full rudder sideslips are
conducted to determine the rudder control forces and deflections out to sideslip angles associated with full
rudder control input (or as limited by a rudder control force of 801 N (180 lbf)) to investigate the potential for
rudder lock and lack of directional stability.
2.2 To check for positive directional stability and for the absence of rudder lock, conduct steady heading
sideslips at increasing sideslip angles until obtaining full rudder control input or a rudder control force of
801 N (180 lbf). If full lateral control is reached before reaching the rudder control limit or 801 (180 lbf) of
rudder control force, continue the test to the rudder limiting condition in a non-steady heading sideslip
manoeuvre.
3 The control limits approved for the aeroplane should not be exceeded when conducting the flight tests
required by CS 25.177.
4 Flight Test Safety Concerns. In planning for and conducting the full rudder sideslips, items relevant to
flight test safety should be considered, including:
a. Inadvertent stalls,
c. Actuation of stick pusher, including the effects of sideslip on angle-of-attack sensor vanes,
d. Heavy buffet,
g. Propulsion system behaviour (e.g., propeller stress, fuel and oil supply, and inlet stability),
j. Position errors and effects on electronic or augmented flight control systems, especially when using the
aeroplane’s production airspeed system.
AMC 25.181
Dynamic Stability
The requirements of CS 25.181 are applicable at all speeds between the stalling speed and VFE, VLE or
VFC/MFC, as appropriate.
AMC 25.201(a)(2)
Stall Demonstration
The power for all power-on stall demonstrations is that power necessary to maintain level flight at a
speed of 1·5 VSR1 at maximum landing weight, with flaps in the approach position and landing gear
retracted, where VSR1 is the reference stall speed in the same conditions (except power). The flap
position to be used to determine this power setting is that position in which the reference stall speed
does not exceed 110% of the reference stall speed with the flaps in the most extended landing
position.
2–B–31
CS–25 BOOK 2
AMC 25.201(b)(1)
Stall Demonstration
Stall demonstrations for compliance with CS 25.201 should include demonstrations with deceleration
devices deployed for all flap positions unless limitations against use of the devices with particular flap
positions are imposed. ‘Deceleration devices’ include spoilers when used as air brakes, and thrust
reversers when use in flight is permitted. Stall demonstrations with deceleration devices deployed
should normally be carried out with power off, except where deployment of the deceleration devices
while power is applied is likely to occur in normal operations (e.g. use of extended air brakes during
landing approach).
AMC 25.201(c)(2)
Turning Flight Stalls At Higher Deceleration Rates
The intent of evaluating higher deceleration rates is to demonstrate safe characteristics at higher rates
of increase of angle of attack than are obtained from the 0.5 m/s2 (1 knot per second) stalls. The specified
airspeed deceleration rate, and associated angle of attack rate, should be maintained up to the point
at which the aeroplane stalls.
AMC 25.201(d)
Stall Demonstration
1 The behaviour of the aeroplane includes the behaviour as affected by the normal functioning
of any systems with which the aeroplane is equipped, including devices intended to alter the stalling
characteristics of the aeroplane.
2 Unless the design of the automatic flight control system of the aeroplane protects against such
an event, the stalling characteristics and adequacy of stall warning, when the aeroplane is stalled
under the control of the automatic flight control system, should be investigated. (See also CS
25.1329(f).)
AMC 25.201(d)(3)
Stall Demonstration
An acceptable interpretation of holding the pitch control on the aft stop for a short time is:
a. The pitch control reaches the aft stop and is held full aft for 2 seconds or until the pitch
attitude stops increasing, whichever occurs later.
b. In the case of turning flight stalls, recovery may be initiated once the pitch control reaches the
aft stop when accompanied by a rolling motion that is not immediately controllable (provided the rolling
motion complies with CS 25.203(c)).
c. For those aeroplanes where stall is defined by full nose up longitudinal control for both
forward and aft C.G., the time at full aft stick should be not less than was used for stall speed
determination, except as permitted by paragraph (b) above.
AMC 25.203
Stall Characteristics
1 Static Longitudinal Stability during the Approach to the Stall. During the approach to the stall
the longitudinal control pull force should increase continuously as speed is reduced from the trimmed
speed to the onset of stall warning. At lower speeds some reduction in longitudinal control pull force
will be acceptable provided that it is not sudden or excessive.
2–B–32
BOOK 2 CS–25
2.1 Where the stall is indicated by a nose-down pitch, this may be accompanied by a rolling
motion that is not immediately controllable, provided that the rolling motion complies with CS
25.203(b) or (c) as appropriate.
2.2 In level wing stalls the bank angle may exceed 20° occasionally, provided that lateral control
is effective during recovery.
3 Deep Stall Penetration. Where the results of wind tunnel tests reveal a risk of a catastrophic
phenomenon (e.g. superstall, a condition at angles beyond the stalling incidence from which it proves
difficult or impossible to recover the aeroplane), studies should be made to show that adequate
recovery control is available at and sufficiently beyond the stalling incidence to avoid such a
phenomenon.
AMC 25.207(b)
Stall Warning
1 A warning which is clear and distinctive to the pilot is one which cannot be misinterpreted or
mistaken for any other warning, and which, without being unduly alarming, impresses itself upon the
pilot and captures his attention regardless of what other tasks and activities are occupying his
attention and commanding his concentration. Where stall warning is to be provided by artificial
means, a stick shaker device producing both a tactile and an audible warning is an Acceptable Means
of Compliance.
2 Where stall warning is provided by means of a device, compliance with the requirement of CS
25.21(e) should be established by ensuring that the device has a high degree of reliability. One
means of complying with this criterion is to provide dual independent systems.
In addition, if the stall warning margin is managed by a system (thrust law, bank angle law, …), stall
warning speed margin required by CS 25.207(c) should be demonstrated, when the speed is reduced
at rates not exceeding 0.5 m/s2 (one knot per second), for the most critical conditions in terms of stall
warning margin, without exceeding 40° bank angle or maximum continuous power or thrust during the
demonstrations. In the case where the management system increases, by design, the stall warning
speed margin from the nominal setting (flight idle, wing level), no additional demonstration needs to be
done.
2 The stall warning speed margins required by CS 25.207(c) and (d) must be determined at a
constant load factor (i.e. 1g for 207(d)). An acceptable data reduction method is to calculate
k = √(C LID/CLSW ) where CLID and C LSW are the C L values respectively at the stall identification and at the
stall warning activation.
3 If the stall warning required by CS 25.207 is provided by a device (e.g. a stick shaker), the
effect of production tolerances on the stall warning system should be considered when evaluating the
stall warning margin required by CS 25.207(c) and (d) and the manoeuvre capabilities required by CS
25.143(g).
a. The stall warning margin required by CS 25.207(c) and (d) should be available with the stall
warning system set to the most critical setting expected in production. Unless another setting would be
2–B–33
CS–25 BOOK 2
provide a lesser margin, the stall warning margin required by CS 25.207(c) should be evaluated
assuming the stall warning system is operating at its high angle of attack limit. For aeroplanes
equipped with a device that abruptly pushes the nose down at a selected angle-of-attack (e.g. a stick
pusher), the stall warning margin required by CS 25.207(c) may be evaluated with both the stall
warning and stall identification (e.g. stick pusher) systems at their nominal angle of attack settings
unless a lesser margin can result from the various system tolerances.
b. The manoeuvre capabilities required by CS 25.143(g) should be available assuming the stall
warning system is operating on its nominal setting. In addition, when the stall warning system is
operating at its low angle of attack limit, the manoeuvre capabilities should not be reduced by more
than 2 degrees of bank angle from those specified in CS 25.143(g).
c. The stall warning margins and manoeuvre capabilities may be demonstrated by flight testing
at the settings specified above for the stall warning and, if applicable, stall identification systems.
Alternatively, compliance may be shown by applying adjustments to flight test data obtained at a
different system setting.
AMC 25.251(e)
Vibration and Buffeting in Cruising Flight
1.1 CS 25.251(e) states that probable inadvertent excursions beyond the buffet onset boundary
may not result in unsafe conditions.
1.2 An acceptable means of compliance with this requirement is to demonstrate by means of flight
tests beyond the buffet onset boundary that hazardous conditions will not be encountered within the
permitted manoeuvring envelope (as defined by CS 25.337) without adequate prior warning being
given by severe buffeting or high stick forces.
1.3 Buffet onset is the lowest level of buffet intensity consistently apparent to the flight crew
during normal acceleration demonstrations in smooth air conditions.
1.4 In flight tests beyond the buffet onset boundary to satisfy paragraph 1.2, the load factor should
be increased until either –
a. The level of buffet becomes sufficient to provide an obvious warning to the pilot which is a
strong deterrent to further application of load factor; or
b. Further increase of load factor requires a stick force in excess of 445 N (100 lbf), or is
impossible because of the limitations of the control system; or
c. The positive limit manoeuvring load factor established in compliance with CS 25.337(b) is
achieved.
1.5 Within the range of load factors defined in paragraph 1.4 no hazardous conditions (such as
hazardous involuntary changes of pitch or roll attitude, engine or systems malfunctioning which require
urgent corrective action by the flight crew, or difficulty in reading the instruments or controlling the
aeroplane) should be encountered.
2.1 CS 25.251(e) requires that the envelopes of load factor, speed, altitude and weight must
provide a sufficient range of speeds and load factors for normal operations.
2–B–34
BOOK 2 CS–25
2.2 An acceptable means of compliance with the requirement is to establish the maximum altitude
at which it is possible to achieve a positive normal acceleration increment of 0·3 g without exceeding
the buffet onset boundary.
AMC 25.253(a)(4)
Lateral Control: Roll Capability
1 Establish a steady 20° banked turn at a speed close to VDF/MDF limited to the extent necessary to
accomplish the following manoeuvre and recovery without exceeding VDF/MDF. Using lateral control
alone, it should be demonstrated that the aeroplane can be rolled to 20° bank angle in the other
direction in not more than 8 seconds. The demonstration should be made in the most adverse
direction. The manoeuvre may be unchecked.
2 For aeroplanes that exhibit an adverse effect on roll rate when rudder is used, it should also be
demonstrated that use of rudder in a conventional manner will not result in a roll capability significantly
below that specified above.
Wing-flaps retracted.
Power: (i) All engines operating at the power required to maintain level flight at VMO/MMO, except that
maximum continuous power need not be exceeded; and
AMC 25.253(a)(5)
High Speed Characteristics
Extension of Speedbrakes. The following guidance is provided to clarify the meaning of the words
“the available range of movements of the pilot’s control” in CS 25.253(a)(5) and to provide guidance
for demonstrating compliance with this requirement. Normally, the available range of movements of
the pilot’s control includes the full physical range of movements of the speedbrake control (i.e., from
stop to stop). Under some circumstances, however, the available range of the pilot’s control may be
restricted to a lesser range associated with in-flight use of the speedbrakes. A means to limit the
available range of movement to an in-flight range may be acceptable if it provides an unmistakable
tactile cue to the pilot when the control reaches the maximum allowable in-flight position, and
compliance with CS 25.697(b) is shown for positions beyond the in-flight range. Additionally, the
applicant's recommended procedures and training must be consistent with the intent to limit the in-
flight range of movements of the speedbrake control.
CS 25.697(b) requires that lift and drag devices intended for ground operation only must have means
to prevent the inadvertent operation of their controls in flight if that operation could be hazardous. If
speedbrake operation is limited to an in-flight range, operation beyond the in-flight range of available
movement of the speedbrake control must be shown to be not hazardous. Two examples of
acceptable unmistakable tactile cues for limiting the in-flight range are designs incorporating either a
gate, or incorporating both a detent and a substantial increase in force to move the control beyond the
2–B–35
CS–25 BOOK 2
detent. It is not an acceptable means of compliance to restrict the use of, or available range of, the
pilot’s control solely by means of an aeroplane Flight Manual limitation or procedural means.
The effect of extension of speedbrakes may be evaluated during other high speed testing and during
the development of emergency descent procedures. It may be possible to infer compliance with CS
25.253(a)(5) by means of this testing. To aid in determining compliance with the qualitative
requirements of this rule, the following quantitative values may be used as a generally acceptable
means of compliance. A load factor should be regarded as excessive if it exceeds 2.0. A nose-down
pitching moment may be regarded as small if it necessitates an incremental control force of less than
89 N (20 lbf) to maintain 1g flight. These values may not be appropriate for all aeroplanes, and
depend on the characteristics of the particular aeroplane design in high speed flight. Other means of
compliance may be acceptable, provided that the Agency finds that compliance has been shown to
the qualitative requirements specified in CS 25.253(a)(5).
AMC 25.255
Out-of-trim Characteristics
1.1 The equivalent degree of trim, specified in CS 25.255(a)(1) for aeroplanes which do not have
a power-operated longitudinal trim system, has not been specified in quantitative terms, and the
particular characteristics of each type of aeroplane must be considered. The intent of the requirement
is that a reasonable amount of out-of-trim should be investigated, such as might occasionally be
applied by a pilot.
1.2 In establishing the maximum mistrim that can be sustained by the autopilot the normal
operation of the autopilot and associated systems should be taken into consideration. Where the
autopilot is equipped with an auto-trim function the amount of mistrim which can be sustained will
generally be small or zero. If there is no auto-trim function, consideration should be given to the
maximum amount of out-of-trim which can be sustained by the elevator servo without causing autopilot
disconnect.
2.1 For showing compliance with CS 25.255(b)(1) for speeds up to VMO/MMO, the datum trim
setting should be the trim setting required for trimmed flight at the particular speed at which the
demonstration is to be made.
2.2 For showing compliance with CS 25.255(b)(1) for speeds from VMO/MMO to VFC/MFC, and for
showing compliance with CS 25.255(b)(2) and (f), the datum trim setting should be the trim setting
required for trimmed flight at VMO/MMO.
3.1 CS 25.255(b)(2) requires that the direction of the primary longitudinal control force may not
reverse when the normal acceleration is varied, for +1 g to the positive and negative values specified,
at speeds above VFC/MFC. The intent of the requirement is that it is permissible that there is a value of
g for which the stick force is zero, provided that the stick force versus g curve has a positive slope at
that point (see Figure 1).
2–B–36
BOOK 2 CS–25
FIGURE 1
3.2 If stick force characteristics are marginally acceptable, it is desirable that there should be no
reversal of normal control sensing, i.e. an aft movement of the control column should produce an
aircraft motion in the nose-up direction and a change in aircraft load factor in the positive direction,
and a forward movement of the control column should change the aircraft load factor in the negative
direction.
3.3 It is further intended that reversals of direction of stick force with negative stick-force gradients
should not be permitted in any mistrim condition within the specified range of mistrim. If test results
indicate that the curves of stick force versus normal acceleration with the maximum required mistrim
have a negative gradient of speeds above VFC/MFC then additional tests may be necessary. The
additional tests should verify that the curves of stick force versus load factor with mistrim less than the
maximum required do not unacceptably reverse, as illustrated in the upper curve of Figure 2. Control
force characteristics as shown in Figure 3, may be considered acceptable, provided that the control
sensing does not reverse (see paragraph 3.2)
FIGURE 2 FIGURE 3
4 Probable Inadvertent Excursions beyond the Boundaries of the Buffet Onset Envelopes. CS
25.255(e) states that manoeuvring load factors associated with probable inadvertent excursions
beyond the boundaries of the buffet onset envelopes determined under CS 25.251(e) need not be
2–B–37
CS–25 BOOK 2
exceeded. It is intended that test flights need not be continued beyond a level of buffet which is
sufficiently severe that a pilot would be reluctant to apply any further increase in load factor.
5.1 CS 25.255(f) requires the ability to produce at least 1·5 g for recovery from an overspeed
condition of VDF/MDF, using either the primary longitudinal control alone or the primary longitudinal
control and the longitudinal trim system. Although the longitudinal trim system may be used to assist
in producing the required normal acceleration, it is not acceptable for recovery to be completely
dependent upon the use of this system. It should be possible to produce 1·2 g by applying not more
than 556 N (125 lbf) of longitudinal control force using the primary longitudinal control alone.
5.2 Recovery capability is generally critical at altitudes where airspeed (VDF) is limiting. If at
higher altitudes (on the MDF boundary) the manoeuvre capability is limited by buffeting of such an
intensity that it is a strong deterrent to further increase in normal acceleration, some reduction of
manoeuvre capability will be acceptable, provided that it does not reduce to below 1·3 g. The entry
speed for flight test demonstrations of compliance with this requirement should be limited to the extent
necessary to accomplish a recovery without exceeding VDF/MDF, and the normal acceleration should
be measured as near to VDF/MDF as is practical.
2–B–38
BOOK 2 CS-25
AMC – SUBPART C
AMC 25.301(b)
Loads
(a) The engine and its mounting structure are to be stressed to the loading cases for the
aeroplane as a whole.
AMC 25.307
Proof of Structure
In deciding the need for and the extent of testing including the load levels to be achieved the following
factors will be considered by the Agency.
a. The confidence which can be attached to the constructors’ overall experience in respect to
certain types of aeroplanes in designing, building and testing aeroplanes.
b. Whether the aeroplane in question is a new type or a development of an existing type having
the same basic structural design and having been previously tested, and how far static strength testing
can be extrapolated to allow for development of the particular type of aeroplane.
c. The importance and value of detail and/or component testing including representation of parts
of structure not being tested, and
d. The degree to which credit can be given for operating experience where it is a matter of
importing for the first time an old type of aeroplane which has not been tested.
AMC 25.335(b)(2)
Design Dive Speed
1. PURPOSE. This AMC sets forth an acceptable means, but not the only means, of
demonstrating compliance with the provisions of CS-25 related to the minimum speed margin between
design cruise speed and design dive speed.
3. BACKGROUND. CS 25.335(b) requires the design dive speed, VD, of the aeroplane to be
established so that the design cruise speed is no greater than 0.8 times the design dive speed, or that
it be based on an upset criterion initiated at the design cruise speed, VC. At altitudes where the cruise
speed is limited by compressibility effects, CS 25.335(b)(2) requires the margin to be not less than
0.05 Mach. Furthermore, at any altitude, the margin must be great enough to provide for atmospheric
variations (such as horizontal gusts and the penetration of jet streams), instrument errors, and
production variations. This AMC provides a rational method for considering the atmospheric variations.
2–C–1
CS-25 BOOK 2
(1) Encounter with a Horizontal Gust. The effect of encounters with a substantially head-
on gust, assumed to act at the most adverse angle between 30 degrees above and 30 degrees below
the flight path, should be considered. The gust velocity should be 15.2 m/s (50 fps) in equivalent
airspeed (EAS) at altitudes up to 6096 m (20,000 feet) . At altitudes above 6096 m (20,000 feet) the
gust velocity may be reduced linearly from 15.2 m/s (50 fps) in EAS at 6096 m (20,000 feet) to 7.6
m/s (25 fps) in EAS at 15240 m (50,000 feet) , above which the gust velocity is considered to be
constant. The gust velocity should be assumed to build up in not more than 2 seconds and last for 30
seconds.
(i) Conditions of horizontal and vertical windshear should be investigated taking into
account the windshear data of this paragraph which are world-wide extreme values.
(ii) Horizontal windshear is the rate of change of horizontal wind speed with horizontal
distance. Encounters with horizontal windshear change the aeroplane apparent head wind in level
flight as the aeroplane traverses into regions of changing wind speed. The horizontal windshear region
is assumed to have no significant vertical gradient of wind speed.
(iii) Vertical windshear is the rate of change of horizontal wind speed with altitude.
Encounters with windshear change the aeroplane apparent head wind as the aeroplane climbs or
descends into regions of changing wind speed. The vertical windshear region changes slowly so that
temporal or spatial changes in the vertical windshear gradient are assumed to have no significant
affect on an aeroplane in level flight.
(iv) With the aeroplane at VC/MC within normal rates of climb and descent, the most
extreme condition of windshear that it might encounter, according to available meteorological data, can
be expressed as follows:
(A) Horizontal Windshear. The jet stream is assumed to consist of a linear shear
of 3.6 KTAS/NM over a distance of 25 NM or of 2.52 KTAS/NM over a distance of 50 NM or of 1.8
KTAS/NM over a distance of 100 NM, whichever is most severe.
(B) Vertical Windshear. The windshear region is assumed to have the most
severe of the following characteristics and design values for windshear intensity and height band. As
shown in Figure 1, the total vertical thickness of the windshear region is twice the height band so that
the windshear intensity specified in Table 1 applies to a vertical distance equal to the height band
above and below the reference altitude. The variation of horizontal wind speed with altitude in the
windshear region is linear through the height band from zero at the edge of the region to a strength at
the reference altitude determined by the windshear intensity multiplied by the height band. Windshear
intensity varies linearly between the reference altitudes in Table 1.
2–C–2
BOOK 2 CS-25
Height Band
(v) The entry of the aeroplane into horizontal and vertical windshear should be
treated as separate cases. Because the penetration of these large scale phenomena is fairly
slow, recovery action by the pilot is usually possible. In the case of manual flight (i.e., when flight
is being controlled by inputs made by the pilot), the aeroplane is assumed to maintain constant
attitude until at least 3 seconds after the operation of the overspeed warning device, at which time
recovery action may be started by using the primary aerodynamic controls and thrust at a normal
acceleration of 1.5g, or the maximum available, whichever is lower.
b. At altitudes where speed is limited by Mach number, a speed margin of .07 Mach between
MC and MD is considered sufficient without further investigation.
AMC 25.337
Limit Manoeuvring Load Factors
The load factor boundary of the manoeuvring envelope is defined by CS 25.337(b) and (c). It is
recognised that constraints which may limit the aircraft’s ability to attain the manoeuvring envelope
load factor boundary may be taken into account in the calculation of manoeuvring loads for each
2–C–3
CS-25 BOOK 2
unique mass and flight condition, provided that those constraints are adequately substantiated. This
substantiation should take account of critical combinations of vertical, rolling and yawing manoeuvres
that may be invoked either statically or dynamically within the manoeuvring envelope.
Examples of the aforementioned constraints include aircraft CN-max, mechanical and/or aerodynamic
limitations of the pitch control, and limitations defined within any flight control software.]
AMC 25.341(b)
Strength and Deformation
1 General. When effects of dynamic response to turbulence are assessed by the continuous
turbulence method, the following criteria can be used:
2 Continuous Gust Design Criteria The gust loads criteria of this paragraph 2 should be applied
to mission analysis or design envelope analysis. (See Technical Reference FAA-ADS-53 ‘Development
of a Power Spectral Gust Design Procedure for Civil Aircraft’ and Technical Report FAA-ADS-54
‘Contributions to the Development of a Power Spectral Gust Design Procedure for Civil Aircraft’ for
detailed information)
2.1 The limit gust loads utilising the continuous turbulence concept should be determined in
accordance with the provisions of either paragraph 2.2 or paragraphs 2.3 and 2.4. For components
stressed by both vertical and lateral components of turbulence, the resultant combined stress should
be considered. The combined stress may be determined on the assumption that vertical and lateral
components are uncorrelated.
2.2 Design Envelope Analysis. The limit loads should be determined in accordance with this
paragraph 2.2.
2.2.1 All critical altitudes, weights, and weight distributions, as specified in CS 25.321(b)(1) to
(b)(3), and all critical speeds within the ranges indicated in paragraph 2.3, should be considered.
σ 2L 1 + 3 (1 ⋅ 339LΩ)
8 2
Φ(Ω) = ×
π 11
[1 + (1 ⋅ 339LΩ) ]
2 6
where–
2.2.3 The limit loads should be obtained by multiplying the A values given by the dynamic analysis
by the following value of Uσ (true gust velocity)
a. At speed VC
2–C–4
BOOK 2 CS-25
i. Uσ = 25·9 m/s (/85 ft/s) true gust velocity in the interval 0 to 9144 m (30 000 ft)g altitude and is
linearly decreased to 9.1 m/s (30 ft/s) true gust velocity at 24 384 m (80 000 ft) altitude.)
ii. Uσ values less than those specified in sub-paragraph a.i. may be used where the applicant
can show by rational means that the gust velocity selected is adequate for the aeroplane being
considered.
However, the Uσ values used may not be less than 22·9 m/s (75 ft/s) with a linear decrease from that
value at 6096 m ( 20 000 ft) to 9·1 m/s (30 ft/s) at 24 384 m (80 000 ft) .
d. At speeds between VB and VC, and between VC and VD. Uσ is given by linear interpolation.
2.2.4 When a stability augmentation system is included in the analysis, the effect of system non-
linearities on loads at the limit load level should be realistically or conservatively accounted for.
2.3 Mission analysis. Limit loads should be determined in accordance with this paragraph 2.3.
2.3.1 The expected utilisation of the aeroplane should be represented by one or more flight profiles
in which the load distribution and the variation with time of speed, altitude, gross weight, and centre of
gravity position are defined. These profiles should be divided into mission segments, or blocks for
analysis and average or effective values of the pertinent parameters defined for each segment.
2.3.2 For each of the mission segments defined under paragraph 2.3.1 values of A and N0 should
be determined by dynamic analysis. A is defined as the ratio of root-mean-square incremental load to
root-mean-square gust velocity and N0 as the radius of gyration of the load power-spectral density
function about zero frequency. The power spectral density of the atmospheric turbulence should be
given by the equation in paragraph 2.2.2.
2.3.3 For each of the load and stress quantities selected, the frequency of exceedance should be
determined as a function of load level by means of the equation,
y − y one − g y − y one − g
N(y) = ∑ tN o
P1 exp −
b1 A
+ P exp −
2
b2 A
where –
2–C–5
CS-25 BOOK 2
2.3.4 The limit gust loads should be read from the frequency of exceedance curves at a frequency of
exceedance of 2 x 10–5 exceedances per hour. Both positive and negative load directions should be
considered in determination of the limit loads.
2.3.5 If a stability augmentation system is utilised to reduce the gust loads, consideration should be
given to the fraction of flight time that the system may be inoperative. The flight profiles of paragraph
2.3.1 should include flight with the system inoperative for this fraction of the flight time. When a
stability augmentation system is included in the analysis, the effect of system non-linearities on loads
at the limit load level should be realistically or conservatively accounted for.
2.4 Supplementary Design Envelope Analysis. In addition to the limit loads defined by paragraph
2.3, limit loads should also be determined in accordance with paragraph 2.2, modified as follows:
2.4.1 In paragraph 2.2.3 a. the values of Uσ = 25·9 m/s (85 ft/s) true is replaced by Uσ =18·3 m/s
(60 ft/s) true in the interval 0 to 9144 m (30 000 ft) altitude and is linearly decreased to 7·6 m/s (25 ft/s)
true at 24 384 m (80 000 ft) altitude.
2.4.2 In paragraph 2.2, the reference to paragraphs 2.2.3a. to 2.2.3c. should be understood as
referring to the paragraph as modified by paragraph 2.4.
2–C–6
BOOK 2 CS-25
2–C–7
CS-25 BOOK 2
AMC 25.345(a)
High Lift Devices (Gust Conditions)
Compliance with CS 25.345(a) may be demonstrated by an analysis in which the solution of the
vertical response equations is made by assuming the aircraft to be rigid. If desired, the analysis may
take account of the effects of structural flexibility on a quasi-flexible basis (i.e. using aerodynamic
derivatives and load distributions corresponding to the distorted structure under maximum gust load).
AMC 25.345(c)
High Lift Devices (Procedure Flight Condition)
1 En-route conditions are flight segments other than take-off, approach and landing. As applied
to the use of high lift devices the following flight phases are to be included in en-route conditions:
– holding in designated areas outside the terminal area of the airport, and
– portion of the flight corresponding to standard arrival routes preceding the interception of the
final approach path, and
2 To apply CS 25.341 (a) gust conditions to CS 25.345(c), the speeds VFC and VFD should be
determined for the flap positions selected in en-route conditions.
These procedures should ensure proper speed margins for flap retraction in the case of severe
turbulence when the aeroplane is in a low speed en-route holding configuration.
AMC 25.365(e)
Pressurised Compartment Loads
The computed opening size from 25.365(e)(2) should be considered only as a mathematical means of
developing ultimate pressure design loads to prevent secondary structural failures. No consideration
need be given to the actual shape of the opening, nor to its exact location on the pressure barrier in the
compartment. The damage and loss of strength at the opening location should not be considered.
A hazard assessment should determine which structures should be required to withstand the resulting
differential pressure loads. The assessment of the secondary consequences of failures of these
structures should address those events that have a reasonable probability of interfering with safe flight
and landing, for example failures of structures supporting critical systems. For this assessment the risk
of impact on the main structure from non critical structures, such as fairings, detached from the aircraft
due to decompression need not be considered.
2–C–8
BOOK 2 CS-25
AMC 25.393(a)
Loads Parallel to Hinge Line
The loads parallel to the hinge line on primary control surfaces and other movable surfaces, such as
tabs, spoilers, speedbrakes, flaps, slats and all-moving tailplanes, should take account of axial play
between the surface and its supporting structure in complying with CS 25.393(a). For the rational
analysis, the critical airframe acceleration time history in the direction of the hinge line from all flight
and ground design conditions (except the emergency landing conditions of CS 25.561) should be
considered. The play assumed in the control surface supporting structure, should include the
maximum tolerable nominal play and the effects of wear.
AMC 25.415
Ground Gust Conditions
1. PURPOSE. This AMC sets forth acceptable methods of compliance with the provisions of
CS-25 dealing with the certification requirements for ground gust conditions. Guidance information
is provided for showing compliance with CS 25.415, relating to structural design of the control
surfaces and systems while taxying with control locks engaged and disengaged and when parked
with control locks engaged. Other methods of compliance with the requirements may be
acceptable.
2. RELATED CS PARAGRAPHS.
3. BACKGROUND.
a. The requirement to consider the effects of ground gusts has been applied to large/transport
aeroplanes since 1950. The purpose of the requirement was to protect the flight control system
from excessive peak ground wind loads while the aeroplane is parked or while taxying downwind.
For developing the original regulation, the control surface load distribution was considered to be
triangular with the peak at the trailing edge representing reversed flow over the control surface.
This assumption, along with assumptions about the wind approach angle and typical control
surface geometries were developed into a table of hinge moment factors and set forth in the
regulation. These hinge moment factors have been carried forward to the existing table in
CS 25.415. The maximum design wind speed was originally set at 96 km/h (88 feet per second (52
knots)) under the presumption that higher speeds were predictable storm conditions and the
aircraft owner could take additional precautions beyond engaging the standard gust locks.
c. There have been several incidents and accidents caused by hidden damage that had previously
occurred in ground gust conditions. Although many of these events were for aeroplanes that had
used the lower wind speeds from the earlier rules, analysis indicates that the most significant
contributor to the damage was the dynamic load effect. The dynamic effects were most significant
for control system designs in which the gust locks were designed to engage the control system at
locations far from the control surface horn. Based on these events additional factors are defined
for use in those portions of the system and surface that could be affected by dynamic effects.
d. The flight control system and surface loads prescribed by CS 25.415 are limit loads based on a
peak wind speed of 120 km/h (65 knots) EAS. In operation, the peak wind speed would most often be
2–C–9
CS-25 BOOK 2
caused by an incremental fluctuation in velocity imposed on top of a less rapidly changing mean wind
speed. Therefore, an appropriate peak wind speed limitation should be reflected in the applicable
documents, when there is a potential risk of structural damage.
4. COMPLIANCE.
a. The ground gust requirements take into account the conditions of the aeroplane parked with
controls locked, and taxying with controls either locked or unlocked. In either of the locked conditions
the control surface loads are assumed to be reacted at the control system locks. In the unlocked
condition the pilot is assumed to be at the controls and the controls are assumed to be powered, if
applicable. In the latter condition, the control surface loads are assumed to be reacted, if necessary, at
the cockpit controls by the pilot(s) up to the limits of the maximum pilot forces and torques given in CS
25.397(c).
b. Where loads are eventually reacted at the cockpit controls, the loads in those parts of the control
system between the control system stops nearest the control surfaces and the cockpit controls need
not exceed those that would result from the application of the specified maximum pilot effort effects.
However, higher loads can be reacted by the control system stops. Those parts of the control system
from the control surfaces to the control system stops nearest the surfaces should be designed to the
resultant limit loads including dynamic effects, if applicable, and regardless of pilot effort limitations.
Similarly, pilot effort limitations would not apply to parts of control systems where the loads are not
eventually reacted at the cockpit controls, for example an aileron control system where the right hand
side aileron loads are reacted by the left hand side aileron, without participation by the pilot(s).
c. In either the taxying condition (controls locked or unlocked) or the parked condition (controls
locked), if the control system flexibility is such that the rate of load application in the ground gust
conditions might produce transient stresses appreciably higher than those corresponding to static
loads, the effects of this rate of application are required to be considered. Manually powered control
systems and control systems where the gust lock is located remotely from the control surface are
examples of designs that might fall in this category. In such cases the control system loads are
required by CS 25.415(e) to be increased by an additional factor over the standard factor of 1.25.
AMC 25.491
Taxy, take-off and landing roll
1. PURPOSE. This AMC sets forth acceptable methods of compliance with the provisions of
CS-25 dealing with the certification requirements for taxy, take-off and landing roll design loads.
Guidance information is provided for showing compliance with CS 25.491, relating to structural
design for aeroplane operation on paved runways and taxy-ways normally used in commercial
operations. Other methods of compliance with the requirements may be acceptable.
2. RELATED CS PARAGRAPHS. The contents of this AMC are considered by the Agency in
determining compliance with CS 25.491. Related paragraphs are CS 25.305(c) and CS 25.235.
3. BACKGROUND.
a. All paved runways and taxy-ways have an inherent degree of surface unevenness, or
roughness. This is the result of the normal tolerances of engineering standards required for
construction, as well as the result of events such as uneven settlement and frost heave. In
addition, repair of surfaces on an active runway or taxy-way can result in temporary ramped
surfaces. Many countries have developed criteria for runway surface roughness. The Inter-national
Civil Aviation Organisation (ICAO) standards are published in ICAO Annex 14.
b. In the late 1940's, as aeroplanes became larger, more flexible, and operated at higher
ground speeds, consideration of dynamic loads during taxy, landing rollout, and take-off became
important in aeroplane design. CS 25.235, CS 25.491 and CS 25.305(c) apply.
2–C–10
BOOK 2 CS-25
c. Several approaches had been taken by different manufacturers in complying with the
noted regulations. If dynamic effects due to rigid body modes or airframe flexibility during taxy
were not considered critical, some manufacturers used a simplified static analysis where a static
inertia force was applied to the aeroplane using a load factor of 2.0 for single axle gears or 1.7 for
multiple axle gears. The lower 1.7 factor was justified based on an assumption that there was a
load alleviating effect resulting from rotation of the beam, on which the forward and aft axles are
attached, about the central pivot point on the strut. The static load factor approach was believed to
encompass any dynamic effects and it had the benefit of a relatively simple analysis.
d. As computers became more powerful and dynamic analysis methods became more
sophisticated, it was found that dynamic effects sometimes resulted in loads greater than those
which were predicted by the static criterion. Some manufacturers performed calculations using a
series of harmonic bumps to represent a runway surface, tuning the bumps to excite various
portions of the structure at a given speed. U.S. Military Standard 8862 defines amplitude and
wavelengths of 1-cosine bumps intended to excite low speed plunge, pitch and wing first bending
modes.
e. Some manufacturers used actual runway profile data to calculate loads. The runway
profiles of the San Francisco Runway 28R or Anchorage Runway 24, which were known to cause
high loads on aeroplanes and were the subject of pilot complaints until resurfaced, have been used
in a series of bi-directional constant speed analytical runs to determine loads. In some cases,
accelerated runs have been used, starting from several points along the runway. The profiles of
those runways are described in NASA Reports CR-119 and TN D-5703. Such deterministic
dynamic analyses have in general proved to be satisfactory.
f. Some manufacturers have used a statistical power spectral density (PSD) approach,
especially to calculate fatigue loads. Extensive PSD runway roughness data exist for numerous
world runways. The PSD approach is not considered practical for calculation of limit loads.
g. Because the various methods described above produce different results, the guidance
information given in paragraphs 4, 5, and 6 of this AMC should be used when demonstrating
compliance with CS 25.491.
b. Aeroplane design loads should be developed for the most critical conditions arising from taxy,
take-off, and landing run. The aeroplane analysis model should include significant aeroplane rigid body
and flexible modes, and the appropriate landing gear and tyre characteristics. Unless the aeroplane
has design features that would result in significant asymmetric loads, only the symmetric cases need
be investigated.
c. Aeroplane steady aerodynamic effects should normally be included. However, they may be
ignored if their deletion is shown to produce conservative loads. Unsteady aerodynamic effects on
dynamic response may be neglected.
d. Conditions should be run at the maximum take-off weight and the maximum landing weight
with critical combinations of wing fuel, payload, and extremes of centre of gravity (c.g.) range. For
aeroplanes with trimable stabilisers, the stabiliser should be set at the appropriate setting for take-off
cases and at the recommended final approach setting for landing cases. The elevator should be
2–C–11
CS-25 BOOK 2
assumed faired relative to the stabiliser throughout the take-off or landing run, unless other normal
procedures are specified in the flight manual.
e. A series of constant speed runs should be made in both directions from 37 km/h (20 knots) up
to the maximum ground speeds expected in normal operation (VR defined at maximum altitude and
temperature for take-off conditions, 1.25 VL2 for landing conditions). Sufficiently small speed
increments should be evaluated to assure that maximum loads are achieved. Constant speed runs
should be made because using accelerated runs may not define the speed/roughness points which
could produce peak dynamic loads. For maximum take-off weight cases, the analysis should account
for normal take-off flap and control settings and consider both zero and maximum thrust. For maximum
landing weight cases, the analysis should account for normal flap and spoiler positions following
landing, and steady pitching moments equivalent to those produced by braking with a coefficient of
friction of 0.3 with and without reverse thrust. The effects of automatic braking systems that reduce
braking in the presence of reverse thrust may be taken into account.
5. DISCRETE LOAD CONDITION. One of the following discrete limit load conditions should be
evaluated:
a. With all landing gears in contact with the ground, the condition of a vertical load equal to 1.7
times the static ground reaction should be investigated under the most adverse aeroplane loading
distribution at maximum take-off weight, with and without thrust from the engines;
(i) Bump wavelengths equal to the mean longitudinal distance between nose and main
landing gears, or between the main and tail landing gears, as appropriate; and separately:
H=A+B L
Where:
6. COMBINED LOAD CONDITION. A condition of combined vertical, side and drag loads should
be investigated for the main landing gear. In the absence of a more rational analysis a vertical load
equal to 90% of the ground reaction from paragraph 5 above should be combined with a drag load of
20% of the vertical load and a side load of 20% of the vertical load. Side loads acting either direction
should be considered.
7. TYRE CONDITIONS. The calculation of maximum gear loads in accordance with paragraphs
4, 5, and 6, may be performed using fully inflated tyres. For multiple wheel units, the maximum gear
loads should be distributed between the wheels in accordance with the criteria of CS 25.511.
2–C–12
TABLE 1
Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev.
0.00 10.30 2.00 10.31 4.00 10.30 6.00 10.30 8.00 10.31 10.00 10.32 12.00 10.33 14.00 10.34
16.00 10.35 18.00 10.36 20.00 10.36 22.00 10.37 24.00 10.37 26.00 10.37 28.00 10.38 30.00 10.39
32.00 10.40 34.00 10.40 36.00 10.41 38.00 10.41 40.00 10.42 42.00 10.43 44.00 10.43 46.00 10.44
48.00 10.44 50.00 10.44 52.00 10.44 54.00 10.44 56.00 10.45 58.00 10.46 60.00 10.47 62.00 10.47
64.00 10.48 66.00 10.49 68.00 10.49 70.00 10.50 72.00 10.50 74.00 10.50 76.00 10.50 78.00 10.50
80.00 10.50 82.00 10.49 84.00 10.49 86.00 10.49 88.00 10.49 90.00 10.50 92.00 10.50 94.00 10.51
96.00 10.51 98.00 10.52 100.00 10.52 102.00 10.52 104.00 10.53 106.00 10.53 108.00 10.54 110.00 10.54
112.00 10.55 114.00 10.55 116.00 10.55 118.00 10.55 120.00 10.54 122.00 10.55 124.00 10.55 126.00 10.56
128.00 10.57 130.00 10.57 132.00 10.57 134.00 10.57 136.00 10.57 138.00 10.58 140.00 10.57 142.00 10.57
144.00 10.58 146.00 10.57 148.00 10.56 150.00 10.56 152.00 10.56 154.00 10.56 156.00 10.56 158.00 10.56
160.00 10.56 162.00 10.56 164.00 10.55 166.00 10.55 168.00 10.55 170.00 10.56 172.00 10.57 174.00 10.57
176.00 10.57 178.00 10.57 180.00 10.56 182.00 10.55 184.00 10.55 186.00 10.55 188.00 10.55 190.00 10.55
192.00 10.56 194.00 10.56 196.00 10.56 198.00 10.56 200.00 10.55 202.00 10.54 204.00 10.53 206.00 10.52
208.00 10.52 210.00 10.52 212.00 10.52 214.00 10.52 216.00 10.52 218.00 10.53 220.00 10.52 222.00 10.52
224.00 10.51 226.00 10.52 228.00 10.52 230.00 10.51 232.00 10.52 234.00 10.52 236.00 10.53 238.00 10.53
240.00 10.53 242.00 10.53 244.00 10.53 246.00 10.53 248.00 10.53 250.00 10.53 252.00 10.53 254.00 10.52
256.00 10.53 258.00 10.54 260.00 10.54 262.00 10.54 264.00 10.54 266.00 10.54 268.00 10.54 270.00 10.55
272.00 10.55 274.00 10.54 276.00 10.55 278.00 10.55 280.00 10.56 282.00 10.57 284.00 10.58 286.00 10.59
288.00 10.60 290.00 10.61 292.00 10.62 294.00 10.63 296.00 10.65 298.00 10.66 300.00 10.66 302.00 10.67
304.00 10.66 306.00 10.67 308.00 10.67 310.00 10.67 312.00 10.67 314.00 10.67 316.00 10.66 318.00 10.66
320.00 10.65 322.00 10.65 324.00 10.65 326.00 10.65 328.00 10.66 330.00 10.67 332.00 10.67 334.00 10.67
336.00 10.68 338.00 10.68 340.00 10.68 342.00 10.69 344.00 10.69 346.00 10.69 348.00 10.70 350.00 10.71
352.00 10.71 354.00 10.72 356.00 10.72 358.00 10.71 360.00 10.72 362.00 10.72 364.00 10.72 366.00 10.71
368.00 10.72 370.00 10.72 372.00 10.73 374.00 10.73 376.00 10.74 378.00 10.75 380.00 10.75 382.00 10.78
Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev.
384.00 10.77 386.00 10.78 388.00 10.79 390.00 10.80 392.00 10.81 394.00 10.81 396.00 10.82 398.00 10.83
400.00 10.84 402.00 10.85 404.00 10.86 406.00 10.86 408.00 10.86 410.00 10.86 412.00 10.85 414.00 10.86
416.00 10.86 418.00 10.87 420.00 10.87 422.00 10.87 424.00 10.87 426.00 10.87 428.00 10.86 430.00 10.85
432.00 10.84 434.00 10.84 436.00 10.83 438.00 10.83 440.00 10.84 442.00 10.85 444.00 10.86 446.00 10.87
448.00 10.87 450.00 10.88 452.00 10.89 454.00 10.90 456.00 10.92 458.00 10.93 460.00 10.94 462.00 10.95
464.00 10.95 466.00 10.95 468.00 10.95 470.00 10.95 472.00 10.95 474.00 10.96 476.00 10.97 478.00 10.98
480.00 10.98 482.00 10.99 484.00 10.99 486.00 10.99 488.00 11.00 490.00 11.01 492.00 11.01 494.00 11.01
496.00 11.01 498.00 10.98 500.00 10.96 502.00 10.95 504.00 10.95 506.00 10.95 508.00 10.96 510.00 10.97
512.00 10.97 514.00 10.98 516.00 10.97 518.00 10.97 520.00 10.98 522.00 10.99 524.00 11.00 526.00 11.01
528.00 11.03 530.00 11.03 532.00 11.03 534.00 11.03 536.00 11.03 538.00 11.03 540.00 11.03 542.00 11.03
544.00 11.02 546.00 11.02 548.00 11.03 550.00 11.04 552.00 11.05 554.00 11.05 556.00 11.04 558.00 11.06
560.00 11.07 562.00 11.07 564.00 11.08 566.00 11.08 568.00 11.09 570.00 11.10 572.00 11.12 574.00 11.13
576.00 11.14 578.00 11.14 580.00 11.15 582.00 11.16 584.00 11.17 586.00 11.17 588.00 11.17 590.00 11.17
592.00 11.17 594.00 11.18 596.00 11.18 598.00 11.18 600.00 11.17 602.00 11.17 604.00 11.17 606.00 11.17
608.00 11.19 610.00 11.17 612.00 11.18 614.00 11.18 616.00 11.18 618.00 11.19 620.00 11.19 622.00 11.19
624.00 11.20 626.00 11.21 628.00 11.21 630.00 11.21 632.00 11.20 634.00 11.20 636.00 11.20 638.00 11.19
640.00 11.18 642.00 11.18 644.00 11.17 646.00 11.16 648.00 11.15 650.00 11.14 652.00 11.14 654.00 11.14
656.00 11.12 658.00 11.11 660.00 11.09 662.00 11.09 664.00 11.09 666.00 11.09 668.00 11.09 670.00 11.09
672.00 11.09 674.00 11.09 676.00 11.09 678.00 11.09 680.00 11.09 682.00 11.09 684.00 11.09 686.00 11.08
688.00 11.08 690.00 11.08 692.00 11.08 694.00 11.07 696.00 11.06 698.00 11.05 700.00 11.04 702.00 11.03
704.00 11.02 706.00 11.01 708.00 11.00 710.00 10.99 712.00 10.99 714.00 10.98 716.00 10.99 718.00 10.98
720.00 10.98 722.00 10.98 724.00 10.98 726.00 10.98 728.00 10.98 730.00 10.99 732.00 10.99 734.00 11.00
736.00 11.00 738.00 11.00 740.00 11.00 742.00 11.00 744.00 11.01 746.00 11.02 748.00 11.02 750.00 11.02
752.00 11.02 754.00 11.02 756.00 11.02 758.00 11.01 760.00 11.01 762.00 11.00 764.00 11.00 766.00 11.00
768.00 11.00 770.00 11.00 772.00 11.00 774.00 10.99 776.00 10.99 778.00 10.98 780.00 10.99 782.00 10.99
784.00 11.00 786.00 11.01 788.00 11.01 790.00 11.01 792.00 11.03 794.00 11.04 796.00 11.03 798.00 11.05
800.00 11.06 802.00 11.07 804.00 11.06 806.00 11.07 808.00 11.08 810.00 11.08 812.00 11.08 814.00 11.09
816.00 11.09 818.00 11.08 820.00 11.08 822.00 11.08 824.00 11.08 826.00 11.08 828.00 11.08 830.00 11.07
832.00 11.08 834.00 11.08 836.00 11.08 838.00 11.08 840.00 11.09 842.00 11.08 844.00 11.08 846.00 11.07
848.00 11.07 850.00 11.06 852.00 11.05 854.00 11.05 856.00 11.04 858.00 11.05 860.00 11.04 862.00 11.04
864.00 11.04 866.00 11.04 868.00 11.04 870.00 11.04 872.00 11.04 874.00 11.03 876.00 11.03 878.00 11.03
880.00 11.03 882.00 11.02 884.00 11.02 886.00 11.02 888.00 11.02 890.00 11.02 892.00 11.02 894.00 11.03
896.00 11.03 898.00 11.04 900.00 11.05 902.00 11.05 904.00 11.06 906.00 11.06 908.00 11.06 910.00 11.07
912.00 11.07 914.00 11.07 916.00 11.07 918.00 11.07 920.00 11.08 922.00 11.08 924.00 11.07 926.00 11.07
928.00 11.07 930.00 11.06 932.00 11.06 934.00 11.06 936.00 11.06 938.00 11.06 940.00 11.07 942.00 11.07
944.00 11.08 946.00 11.08 948.00 11.09 950.00 11.09 952.00 11.09 954.00 11.09 956.00 11.10 958.00 11.09
Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev.
960.00 11.09 962.00 11.09 964.00 11.09 966.00 11.08 968.00 11.08 970.00 11.07 972.00 11.07 974.00 11.06
976.00 11.07 978.00 11.09 980.00 11.10 982.00 11.10 984.00 11.11 986.00 11.11 988.00 11.12 990.00 11.12
992.00 11.12 994.00 11.11 996.00 11.11 998.00 11.11 1000.00 11.11 1002.00 11.11 1004.00 11.10 1006.00 11.11
1008.00 11.11 1010.00 11.12 1012.00 11.12 1014.00 11.12 1016.00 11.11 1018.00 11.11 1020.00 11.12 1022.00 11.11
1024.00 11.11 1026.00 11.11 1028.00 11.10 1030.00 11.10 1032.00 11.12 1034.00 11.13 1036.00 11.15 1038.00 11.16
1040.00 11.17 1042.00 11.18 1044.00 11.18 1046.00 11.19 1048.00 11.19 1050.00 11.20 1052.00 11.22 1054.00 11.22
1056.00 11.23 1058.00 11.23 1060.00 11.23 1062.00 11.24 1064.00 11.25 1066.00 11.25 1068.00 11.26 1070.00 11.24
1072.00 11.27 1074.00 11.28 1076.00 11.28 1078.00 11.30 1080.00 11.31 1082.00 11.32 1084.00 11.33 1086.00 11.34
1088.00 11.34 1090.00 11.34 1092.00 11.34 1094.00 11.33 1096.00 11.32 1098.00 11.32 1100.00 11.31 1102.00 11.32
1104.00 11.32 1106.00 11.31 1108.00 11.31 1110.00 11.31 1112.00 11.32 1114.00 11.31 1116.00 11.32 1118.00 11.33
1120.00 11.34 1122.00 11.35 1124.00 11.35 1126.00 11.36 1128.00 11.36 1130.00 11.36 1132.00 11.37 1134.00 11.37
1136.00 11.37 1138.00 11.37 1140.00 11.38 1142.00 11.38 1144.00 11.38 1146.00 11.38 1148.00 11.38 1150.00 11.38
1152.00 11.38 1154.00 11.38 1156.00 11.38 1158.00 11.37 1160.00 11.37 1162.00 11.37 1164.00 11.37 1166.00 11.38
1168.00 11.38 1170.00 11.39 1172.00 11.38 1174.00 11.38 1176.00 11.39 1178.00 11.40 1180.00 11.41 1182.00 11.41
1184.00 11.42 1186.00 11.43 1188.00 11.44 1190.00 11.44 1192.00 11.45 1194.00 11.46 1196.00 11.46 1198.00 11.46
1200.00 11.46 1202.00 11.47 1204.00 11.48 1206.00 11.48 1208.00 11.48 1210.00 11.49 1212.00 11.50 1214.00 11.50
1216.00 11.50 1218.00 11.50 1220.00 11.50 1222.00 11.50 1224.00 11.49 1226.00 11.49 1228.00 11.49 1230.00 11.48
1232.00 11.47 1234.00 11.46 1236.00 11.46 1238.00 11.48 1240.00 11.46 1242.00 11.47 1244.00 11.47 1246.00 11.47
1248.00 11.47 1250.00 11.46 1252.00 11.45 1254.00 11.45 1256.00 11.45 1258.00 11.46 1260.00 11.46 1262.00 11.46
1264.00 11.45 1266.00 11.45 1268.00 11.45 1270.00 11.45 1272.00 11.45 1274.00 11.46 1276.00 11.46 1278.00 11.46
1280.00 11.48 1282.00 11.47 1284.00 11.47 1286.00 11.48 1288.00 11.48 1290.00 11.48 1292.00 11.48 1294.00 11.49
1296.00 11.49 1298.00 11.50 1300.00 11.51 1302.00 11.52 1304.00 11.52 1306.00 11.52 1308.00 11.52 1310.00 11.52
1312.00 11.52 1314.00 11.52 1316.00 11.53 1318.00 11.52 1320.00 11.52 1322.00 11.52 1324.00 11.53 1326.00 11.53
1328.00 11.53 1330.00 11.53 1332.00 11.53 1334.00 11.53 1336.00 11.54 1338.00 11.53 1340.00 11.52 1342.00 11.52
1344.00 11.51 1346.00 11.53 1348.00 11.52 1350.00 11.54 1352.00 11.53 1354.00 11.54 1356.00 11.53 1358.00 11.54
1360.00 11.53 1362.00 11.54 1364.00 11.55 1366.00 11.54 1368.00 11.54 1370.00 11.54 1372.00 11.54 1374.00 11.53
1376.00 11.52 1378.00 11.51 1380.00 11.50 1382.00 11.49 1384.00 11.49 1386.00 11.49 1388.00 11.49 1390.00 11.49
1392.00 11.48 1394.00 11.47 1396.00 11.47 1398.00 11.47 1400.00 11.46 1402.00 11.47 1404.00 11.47 1406.00 11.48
1408.00 11.47 1410.00 11.46 1412.00 11.46 1414.00 11.46 1416.00 11.46 1418.00 11.46 1420.00 11.47 1422.00 11.47
1424.00 11.47 1426.00 11.46 1428.00 11.46 1430.00 11.44 1432.00 11.43 1434.00 11.41 1436.00 11.40 1438.00 11.39
1440.00 11.38 1442.00 11.37 1444.00 11.36 1446.00 11.36 1448.00 11.35 1450.00 11.35 1452.00 11.35 1454.00 11.35
1456.00 11.35 1458.00 11.34 1460.00 11.34 1462.00 11.33 1464.00 11.32 1466.00 11.32 1468.00 11.32 1470.00 11.31
1472.00 11.31 1474.00 11.30 1476.00 11.29 1478.00 11.29 1480.00 11.28 1482.00 11.28 1484.00 11.28 1486.00 11.28
1488.00 11.28 1490.00 11.27 1492.00 11.27 1494.00 11.27 1496.00 11.26 1498.00 11.26 1500.00 11.25 1502.00 11.25
1504.00 11.24 1506.00 11.23 1508.00 11.22 1510.00 11.21 1512.00 11.19 1514.00 11.18 1516.00 11.17 1518.00 11.17
1520.00 11.15 1522.00 11.13 1524.00 11.12 1526.00 11.10 1528.00 11.10 1530.00 11.18 1532.00 11.17 1534.00 11.14
Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev.
1536.00 11.14 1538.00 11.12 1540.00 11.00 1542.00 10.97 1544.00 10.95 1546.00 10.94 1548.00 10.92 1550.00 10.91
1552.00 10.92 1554.00 10.92 1556.00 10.91 1558.00 10.93 1560.00 10.93 1562.00 10.93 1564.00 10.93 1566.00 10.93
1568.00 10.93 1570.00 10.93 1572.00 10.93 1574.00 10.93 1576.00 10.93 1578.00 10.93 1580.00 10.94 1582.00 10.94
1584.00 10.94 1586.00 10.94 1588.00 10.95 1590.00 10.94 1592.00 10.93 1594.00 10.94 1596.00 10.94 1598.00 10.93
1600.00 10.92 1602.00 10.92 1604.00 10.92 1606.00 10.91 1608.00 10.91 1610.00 10.91 1612.00 10.91 1614.00 10.90
1616.00 10.89 1618.00 10.88 1620.00 10.87* 1622.00 10.89 1624.00 10.88 1626.00 10.88 1628.00 10.88 1630.00 10.87
1632.00 10.86 1634.00 10.85 1636.00 10.86 1638.00 10.86 1640.00 10.85 1642.00 10.85 1644.00 10.85 1646.00 10.84
1648.00 10.84 1650.00 10.84 1652.00 10.83 1654.00 10.83 1656.00 10.82 1658.00 10.82 1660.00 10.81 1662.00 10.81
1664.00 10.80 1666.00 10.79 1668.00 10.79 1670.00 10.79 1672.00 10.79 1674.00 10.79 1676.00 10.79 1678.00 10.80
1680.00 10.80 1682.00 10.81 1684.00 10.82 1686.00 10.82 1688.00 10.83 1690.00 10.84 1692.00 10.85 1694.00 10.85
1696.00 10.85 1698.00 10.87 1700.00 10.87 1702.00 10.88 1704.00 10.87 1706.00 10.88 1708.00 10.87 1710.00 10.87
1712.00 10.87 1714.00 10.87 1716.00 10.86 1718.00 10.85 1720.00 10.84 1722.00 10.84 1724.00 10.84 1726.00 10.84
1728.00 10.84 1730.00 10.83 1732.00 10.82 1734.00 10.82 1736.00 10.82 1738.00 10.82 1740.00 10.82 1742.00 10.82
1744.00 10.83 1746.00 10.82 1748.00 10.83 1750.00 10.82 1752.00 10.82 1754.00 10.82 1756.00 10.82 1758.00 10.81
1760.00 10.81 1762.00 10.81 1764.00 10.81 1766.00 10.82 1768.00 10.82 1770.00 10.82 1772.00 10.83 1774.00 10.83
1776.00 10.83 1778.00 10.84 1780.00 10.84 1782.00 10.85 1784.00 10.86 1786.00 10.86 1788.00 10.86 1790.00 10.88
1792.00 10.87 1794.00 10.86 1796.00 10.86 1798.00 10.86 1800.00 10.87 1802.00 10.87 1804.00 10.86 1806.00 10.85
1808.00 10.85 1810.00 10.89 1812.00 10.91 1814.00 10.91 1816.00 10.92 1818.00 10.92 1820.00 10.93 1822.00 10.93
1824.00 10.93 1826.00 10.94 1828.00 10.94 1830.00 10.95 1832.00 10.94 1834.00 10.93 1836.00 10.93 1838.00 10.92
1840.00 10.93 1842.00 10.91 1844.00 10.91 1846.00 10.90 1848.00 10.90 1850.00 10.90 1852.00 10.91 1854.00 10.91
1856.00 10.89 1858.00 10.90 1860.00 10.91 1862.00 10.91 1864.00 10.91 1866.00 10.92 1868.00 10.93 1870.00 10.94
1872.00 10.94 1874.00 10.94 1876.00 10.94 1878.00 10.94 1880.00 10.95 1882.00 10.93 1884.00 10.93 1886.00 10.93
1888.00 10.93 1890.00 10.92 1892.00 10.93 1894.00 10.93 1896.00 10.93 1898.00 10.93 1900.00 10.91 1902.00 10.90
1904.00 10.91 1906.00 10.91 1908.00 10.91 1910.00 10.91 1912.00 10.91 1914.00 10.91 1916.00 10.91 1918.00 10.90
1920.00 10.90 1922.00 10.89 1924.00 10.90 1926.00 10.90 1928.00 10.90 1930.00 10.91 1932.00 10.90 1934.00 10.91
1936.00 10.89 1938.00 10.89 1940.00 10.89 1942.00 10.89 1944.00 10.89 1946.00 10.88 1948.00 10.88 1950.00 10.87
1952.00 10.87 1954.00 10.87 1956.00 10.86 1958.00 10.88 1960.00 10.87 1962.00 10.86 1964.00 10.87 1966.00 10.87
1968.00 10.86 1970.00 10.85 1972.00 10.85 1974.00 10.85 1976.00 10.86 1978.00 10.85 1980.00 10.86 1982.00 10.86
1984.00 10.86 1986.00 10.87 1988.00 10.87 1990.00 10.87 1992.00 10.87 1994.00 10.87 1996.00 10.88 1998.00 10.87
2000.00 10.88 2002.00 10.87 2004.00 10.88 2006.00 10.88 2008.00 10.88 2010.00 10.88 2012.00 10.88 2014.00 10.89
2016.00 10.90 2018.00 10.89 2020.00 10.89 2022.00 10.89 2024.00 10.89 2026.00 10.90 2028.00 10.89 2030.00 10.89
2032.00 10.88 2034.00 10.87 2036.00 10.88 2038.00 10.87 2040.00 10.87 2042.00 10.87 2044.00 10.87 2046.00 10.88
2048.00 10.88 2050.00 10.88 2052.00 10.88 2054.00 10.88 2056.00 10.88 2058.00 10.89 2060.00 10.89 2062.00 10.89
2064.00 10.89 2066.00 10.89 2068.00 10.89 2070.00 10.89 2072.00 10.88 2074.00 10.88 2076.00 10.89 2078.00 10.88
2080.00 10.89 2082.00 10.88 2084.00 10.88 2086.00 10.88 2088.00 10.88 2090.00 10.88 2092.00 10.87 2094.00 10.87
2096.00 10.87 2098.00 10.87 2100.00 10.87 2102.00 10.88 2104.00 10.88 2106.00 10.88 2108.00 10.89 2110.00 10.89
Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev.
2112.00 10.90 2114.00 10.91 2116.00 10.92 2118.00 10.92 2120.00 10.93 2122.00 10.92 2124.00 10.92 2126.00 10.92
2128.00 10.92 2130.00 10.92 2132.00 10.92 2134.00 10.92 2136.00 10.93 2138.00 10.93 2140.00 10.93 2142.00 10.93
2144.00 10.93 2146.00 10.94 2148.00 10.93 2150.00 10.93 2152.00 10.93 2154.00 10.93 2156.00 10.93 2158.00 10.92
2160.00 10.92 2162.00 10.91 2164.00 10.90 2166.00 10.92 2168.00 10.91 2170.00 10.91 2172.00 10.90 2174.00 10.90
2176.00 10.90 2178.00 10.88 2180.00 10.88 2182.00 10.86 2184.00 10.85 2186.00 10.85 2188.00 10.84 2190.00 10.84
2192.00 10.84 2194.00 10.84 2196.00 10.85 2198.00 10.85 2200.00 10.85 2202.00 10.85 2204.00 10.85 2206.00 10.85
2208.00 10.86 2210.00 10.86 2212.00 10.86 2214.00 10.87 2216.00 10.88 2218.00 10.88 2220.00 10.89 2222.00 10.90
2224.00 10.91 2226.00 10.91 2228.00 10.92 2230.00 10.92 2232.00 10.93 2234.00 10.94 2236.00 10.94 2238.00 10.95
2240.00 10.96 2242.00 10.96 2244.00 10.97 2246.00 10.99 2248.00 10.99 2250.00 10.99 2252.00 10.99 2254.00 11.00
2256.00 11.00 2258.00 11.00 2260.00 11.01 2262.00 11.01 2264.00 11.02 2266.00 11.02 2268.00 11.02 2270.00 11.04
2272.00 11.05 2274.00 11.05 2276.00 11.06 2278.00 11.06 2280.00 11.05 2282.00 11.04 2284.00 11.03 2286.00 11.03
2288.00 11.02 2290.00 11.03 2292.00 11.03 2294.00 11.04 2296.00 11.05 2298.00 11.06 2300.00 11.07 2302.00 11.09
2304.00 11.10 2306.00 11.10 2308.00 11.11 2310.00 11.12 2312.00 11.14 2314.00 11.14 2316.00 11.15 2318.00 11.16
2320.00 11.16 2322.00 11.16 2324.00 11.15 2326.00 11.15 2328.00 11.16 2330.00 11.15 2332.00 11.14 2334.00 11.14
2336.00 11.14 2338.00 11.14 2340.00 11.14 2342.00 11.14 2344.00 11.15 2346.00 11.15 2348.00 11.15 2350.00 11.15
2352.00 11.15 2354.00 11.15 2356.00 11.16 2358.00 11.16 2360.00 11.15 2362.00 11.15 2364.00 11.16 2366.00 11.16
2368.00 11.16 2370.00 11.16 2372.00 11.16 2374.00 11.16 2376.00 11.16 2378.00 11.16 2380.00 11.17 2382.00 11.17
2384.00 11.17 2386.00 11.17 2388.00 11.17 2390.00 11.17 2392.00 11.17 2394.00 11.16 2396.00 11.15 2398.00 11.15
2400.00 11.14 2402.00 11.14 2404.00 11.14 2406.00 11.13 2408.00 11.12 2410.00 11.12 2412.00 11.12 2414.00 11.12
2416.00 11.12 2418.00 11.12 2420.00 11.13 2422.00 11.13 2424.00 11.14 2426.00 11.15 2428.00 11.16 2430.00 11.17
2432.00 11.18 2434.00 11.19 2436.00 11.20 2438.00 11.20 2440.00 11.22 2442.00 11.23 2444.00 11.24 2446.00 11.24
2448.00 11.25 2450.00 11.26 2452.00 11.27 2454.00 11.28 2456.00 11.28 2458.00 11.29 2460.00 11.30 2462.00 11.30
2464.00 11.30 2466.00 11.31 2468.00 11.30 2470.00 11.31 2472.00 11.31 2474.00 11.31 2476.00 11.31 2478.00 11.30
2480.00 11.30 2482.00 11.30 2484.00 11.29 2486.00 11.29 2488.00 11.29 2490.00 11.29 2492.00 11.29 2494.00 11.29
2496.00 11.29 2498.00 11.29 2500.00 11.29 2502.00 11.30 2504.00 11.30 2506.00 11.31 2508.00 11.31 2510.00 11.32
2512.00 11.32 2514.00 11.33 2516.00 11.33 2518.00 11.34 2520.00 11.35 2522.00 11.35 2524.00 11.35 2526.00 11.35
2528.00 11.35 2530.00 11.35 2532.00 11.36 2534.00 11.36 2536.00 11.35 2538.00 11.35 2540.00 11.35 2542.00 11.35
2544.00 11.35 2546.00 11.35 2548.00 11.34 2550.00 11.34 2552.00 11.34 2554.00 11.34 2556.00 11.35 2558.00 11.35
2560.00 11.35 2562.00 11.34 2564.00 11.33 2566.00 11.33 2568.00 11.33 2570.00 11.33 2572.00 11.33 2574.00 11.33
2576.00 11.33 2578.00 11.32 2580.00 11.33 2582.00 11.33 2584.00 11.33 2586.00 11.33 2588.00 11.33 2590.00 11.34
2592.00 11.34 2594.00 11.34 2596.00 11.35 2598.00 11.35 2600.00 11.35 2602.00 11.35 2604.00 11.35 2606.00 11.35
2608.00 11.35 2610.00 11.35 2612.00 11.36 2614.00 11.36 2616.00 11.36 2618.00 11.35 2620.00 11.35 2622.00 11.35
2624.00 11.35 2626.00 11.35 2628.00 11.35 2630.00 11.36 2632.00 11.36 2634.00 11.36 2636.00 11.36 2638.00 11.36
2640.00 11.37 2642.00 11.38 2644.00 11.38 2646.00 11.39 2648.00 11.39 2650.00 11.40 2652.00 11.41 2654.00 11.42
2656.00 11.42 2658.00 11.43 2660.00 11.43 2662.00 11.42 2664.00 11.42 2666.00 11.43 2668.00 11.43 2670.00 11.43
2672.00 11.43 2674.00 11.43 2676.00 11.43 2678.00 11.44 2680.00 11.44 2682.00 11.45 2684.00 11.46 2686.00 11.46
Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev.
2688.00 11.47 2690.00 11.48 2692.00 11.48 2694.00 11.49 2696.00 11.49 2698.00 11.50 2700.00 11.50 2702.00 11.51
2704.00 11.52 2706.00 11.52 2708.00 11.52 2710.00 11.52 2712.00 11.52 2714.00 11.52 2716.00 11.52 2718.00 11.52
2720.00 11.52 2722.00 11.52 2724.00 11.51 2726.00 11.51 2728.00 11.51 2730.00 11.50 2732.00 11.50 2734.00 11.50
2736.00 11.50 2738.00 11.51 2740.00 11.51 2742.00 11.51 2744.00 11.52 2746.00 11.52 2748.00 11.52 2750.00 11.52
2752.00 11.53 2754.00 11.53 2756.00 11.53 2758.00 11.52 2760.00 11.52 2762.00 11.52 2764.00 11.52 2766.00 11.52
2768.00 11.52 2770.00 11.53 2772.00 11.53 2774.00 11.53 2776.00 11.54 2778.00 11.53 2780.00 11.53 2782.00 11.54
2784.00 11.54 2786.00 11.54 2788.00 11.54 2790.00 11.53 2792.00 11.53 2794.00 11.53 2796.00 11.53 2798.00 11.54
2800.00 11.54 2802.00 11.54 2804.00 11.55 2806.00 11.55 2808.00 11.55 2810.00 11.56 2812.00 11.55 2814.00 11.55
2816.00 11.55 2818.00 11.55 2820.00 11.54 2822.00 11.53 2824.00 11.53 2826.00 11.53 2828.00 11.51 2830.00 11.52
2832.00 11.52 2834.00 11.53 2836.00 11.53 2838.00 11.54 2840.00 11.55 2842.00 11.56 2844.00 11.56 2846.00 11.57
2848.00 11.57 2850.00 11.57 2852.00 11.58 2854.00 11.58 2856.00 11.58 2858.00 11.58 2860.00 11.58 2862.00 11.58
2864.00 11.59 2866.00 11.59 2868.00 11.59 2870.00 11.59 2872.00 11.58 2874.00 11.57 2876.00 11.57 2878.00 11.58
2880.00 11.57 2882.00 11.57 2884.00 11.57 2886.00 11.58 2888.00 11.58 2890.00 11.59 2892.00 11.60 2894.00 11.62
2896.00 11.61 2898.00 11.61 2900.00 11.61 2902.00 11.61 2904.00 11.61 2906.00 11.62 2908.00 11.63 2910.00 11.64
2912.00 11.65 2914.00 11.66 2916.00 11.67 2918.00 11.67 2920.00 11.67 2922.00 11.68 2924.00 11.70 2926.00 11.72
2928.00 11.73 2930.00 11.74 2932.00 11.76 2934.00 11.77 2936.00 11.78 2938.00 11.80 2940.00 11.82 2942.00 11.82
2944.00 11.82 2946.00 11.83 2948.00 11.82 2950.00 11.82 2952.00 11.83 2954.00 11.84 2956.00 11.83 2958.00 11.83
2960.00 11.83 2962.00 11.83 2964.00 11.83 2966.00 11.83 2968.00 11.84 2970.00 11.85 2972.00 11.86 2974.00 11.87
2976.00 11.88 2978.00 11.88 2980.00 11.89 2982.00 11.90 2984.00 11.90 2986.00 11.90 2988.00 11.90 2990.00 11.90
2992.00 11.90 2994.00 11.91 2996.00 11.91 2998.00 11.90 3000.00 11.91 3002.00 11.91 3004.00 11.91 3006.00 11.91
3008.00 11.90 3010.00 11.91 3012.00 11.91 3014.00 11.92 3016.00 11.92 3018.00 11.92 3020.00 11.92 3022.00 11.92
3024.00 11.92 3026.00 11.92 3028.00 11.91 3030.00 11.91 3032.00 11.92 3034.00 11.91 3036.00 11.91 3038.00 11.91
3040.00 11.91 3042.00 11.90 3044.00 11.90 3046.00 11.90 3048.00 11.90 3050.00 11.90 3052.00 11.90 3054.00 11.90
3056.00 11.90 3058.00 11.90 3060.00 11.90 3062.00 11.91 3064.00 11.92 3066.00 11.92 3068.00 11.92 3070.00 11.93
3072.00 11.93 3074.00 11.93 3076.00 11.93 3078.00 11.94 3080.00 11.94 3082.00 11.95 3084.00 11.95 3086.00 11.95
3088.00 11.96 3090.00 11.96 3092.00 11.96 3094.00 11.96 3096.00 11.96 3098.00 11.96 3100.00 11.95 3102.00 11.94
3104.00 11.93 3106.00 11.92 3108.00 11.92 3110.00 11.92 3112.00 11.92 3114.00 11.92 3116.00 11.92 3118.00 11.92
3120.00 11.92 3122.00 11.92 3124.00 11.92 3126.00 11.92 3128.00 11.91 3130.00 11.90 3132.00 11.90 3134.00 11.90
3136.00 11.90 3138.00 11.90 3140.00 11.90 3142.00 11.90 3144.00 11.90 3146.00 11.90 3148.00 11.90 3150.00 11.90
3152.00 11.90 3154.00 11.90 3156.00 11.90 3158.00 11.90 3160.00 11.90 3162.00 11.89 3164.00 11.88 3166.00 11.88
3168.00 11.87 3170.00 11.87 3172.00 11.86 3174.00 11.86 3176.00 11.85 3178.00 11.85 3180.00 11.84 3182.00 11.84
3184.00 11.84 3186.00 11.84 3188.00 11.84 3190.00 11.85 3192.00 11.87 3194.00 11.89 3196.00 11.89 3198.00 11.90
3200.00 11.89 3202.00 11.92 3204.00 11.95 3206.00 11.95 3208.00 11.95 3210.00 11.94 3212.00 11.94 3214.00 11.93
3216.00 11.92 3218.00 11.92 3220.00 11.91 3222.00 11.90 3224.00 11.90 3226.00 11.89 3228.00 11.88 3230.00 11.87
3232.00 11.86 3234.00 11.85 3236.00 11.84 3238.00 11.84 3240.00 11.84 3242.00 11.83 3244.00 11.82 3246.00 11.82
3248.00 11.81 3250.00 11.83 3252.00 11.83 3254.00 11.83 3256.00 11.84 3258.00 11.84 3260.00 11.84 3262.00 11.84
Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev.
3264.00 11.82 3266.00 11.83 3268.00 11.82 3270.00 11.83 3272.00 11.83 3274.00 11.84 3276.00 11.84 3278.00 11.84
3280.00 11.85 3282.00 11.84 3284.00 11.84 3286.00 11.84 3288.00 11.85 3290.00 11.85 3292.00 11.85 3294.00 11.86
3296.00 11.86 3298.00 11.84 3300.00 11.84 3302.00 11.84 3304.00 11.84 3306.00 11.84 3308.00 11.84 3310.00 11.84
3312.00 11.84 3314.00 11.84 3316.00 11.84 3318.00 11.84 3320.00 11.84 3322.00 11.83 3324.00 11.83 3326.00 11.83
3328.00 11.82 3330.00 11.83 3332.00 11.83 3334.00 11.83 3336.00 11.82 3338.00 11.82 3340.00 11.83 3342.00 11.82
3344.00 11.83 3346.00 11.83 3348.00 11.84 3350.00 11.84 3352.00 11.83 3354.00 11.83 3356.00 11.83 3358.00 11.83
3360.00 11.83 3362.00 11.84 3364.00 11.84 3366.00 11.84 3368.00 11.85 3370.00 11.85 3372.00 11.85 3374.00 11.85
3376.00 11.84 3378.00 11.84 3380.00 11.85 3382.00 11.85 3384.00 11.86 3386.00 11.86 3388.00 11.87 3390.00 11.87
3392.00 11.87 3394.00 11.87 3396.00 11.87 3398.00 11.86 3400.00 11.87 3402.00 11.87 3404.00 11.88 3406.00 11.89
3408.00 11.89 3410.00 11.89 3412.00 11.91 3414.00 11.91 3416.00 11.92 3418.00 11.93 3420.00 11.95 3422.00 11.95
3424.00 11.96 3426.00 11.96 3428.00 11.96 3430.00 11.96 3432.00 11.95 3434.00 11.96 3436.00 11.96 3438.00 11.96
3440.00 11.96 3442.00 11.95 3444.00 11.95 3446.00 11.94 3448.00 11.96 3450.00 11.98 3452.00 11.99 3454.00 12.01
3456.00 12.03 3458.00 12.04 3460.00 12.05 3462.00 12.05 3464.00 12.05 3466.00 12.05 3468.00 12.05 3470.00 12.05
3472.00 12.04 3474.00 12.06 3476.00 12.06 3478.00 12.07 3480.00 12.07 3482.00 12.07 3484.00 12.07 3486.00 12.06
3488.00 12.07 3490.00 12.07 3492.00 12.08 3494.00 12.08 3496.00 12.08 3498.00 12.09 3500.00 12.09 3502.00 12.08
3504.00 12.08 3506.00 12.08 3508.00 12.08 3510.00 12.08 3512.00 12.09 3514.00 12.10 3516.00 12.10 3518.00 12.10
3520.00 12.10 3522.00 12.10 3524.00 12.11 3526.00 12.11 3528.00 12.12 3530.00 12.13 3532.00 12.13 3534.00 12.13
3536.00 12.13 3538.00 12.14 3540.00 12.14 3542.00 12.13 3544.00 12.13 3546.00 12.13 3548.00 12.11 3550.00 12.10
3552.00 12.07 3554.00 12.06 3556.00 12.07 3558.00 12.08 3560.00 12.09 3562.00 12.10 3564.00 12.11 3566.00 12.11
3568.00 12.12 3570.00 12.06 3572.00 12.01 3574.00 12.03 3576.00 12.04 3578.00 12.05 3580.00 12.05 3582.00 12.06
3584.00 12.06 3586.00 12.05 3588.00 12.04 3590.00 12.03 3592.00 12.02 3594.00 12.02 3596.00 12.02 3598.00 12.02
3600.00 12.01 3602.00 11.99 3604.00 11.98 3606.00 11.94 3608.00 11.94 3610.00 11.93 3612.00 11.93 3614.00 11.92
3616.00 11.91 3618.00 11.90 3620.00 11.90 3622.00 11.90 3624.00 11.90 3626.00 11.90 3628.00 11.91 3630.00 11.90
3632.00 11.88 3634.00 11.87 3636.00 11.87 3638.00 11.86 3640.00 11.86 3642.00 11.85 3644.00 11.86 3646.00 11.86
3648.00 11.85 3650.00 11.85 3652.00 11.85 3654.00 11.86 3656.00 11.86 3658.00 11.87 3660.00 11.86 3662.00 11.86
3664.00 11.85 3666.00 11.84 3668.00 11.85 3670.00 11.85 3672.00 11.87 3674.00 11.89 3676.00 11.88 3678.00 11.88
3680.00 11.88 3682.00 11.89 3684.00 11.90 3686.00 11.91 3688.00 11.91 3690.00 11.91 3692.00 11.91 3694.00 11.92
3696.00 11.92 3698.00 11.93 3700.00 11.94 3702.00 11.94 3704.00 11.95 3706.00 11.95 3708.00 11.95 3710.00 11.95
3712.00 11.95 3714.00 11.96 3716.00 11.95 3718.00 11.95 3720.00 11.96 3722.00 11.97 3724.00 11.98 3726.00 11.98
3728.00 11.99 3730.00 12.00 3732.00 12.00 3734.00 11.99 3736.00 11.99 3738.00 11.99 3740.00 12.00 3742.00 12.00
3744.00 12.01 3746.00 12.02 3748.00 12.02 3750.00 12.03 3752.00 12.04 3754.00 12.05 3756.00 12.06 3758.00 12.06
3760.00 12.06 3762.00 12.06 3764.00 12.06 3766.00 12.06 3768.00 12.06 3770.00 12.06 3772.00 12.07 3774.00 12.08
3776.00 12.09 3778.00 12.10 3780.00 12.09 3782.00 12.12 3784.00 12.13 3786.00 12.14 3788.00 12.13 3790.00 12.14
3792.00 12.14 3794.00 12.14 3796.00 12.15 3798.00 12.15 3800.00 12.16 3802.00 12.16 3804.00 12.17 3806.00 12.17
3808.00 12.17 3810.00 12.15 3812.00 12.14 3814.00 12.13 3816.00 12.12 3818.00 12.11 3820.00 12.10 3822.00 12.09
3824.00 12.09 3826.00 12.09 3828.00 12.08 3830.00 12.07 3832.00 12.07 3834.00 12.06 3836.00 12.05 3838.00 12.03
Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev. Dist. Elev.
3840.00 12.03 3842.00 12.02 3844.00 12.01 3846.00 12.02 3848.00 12.01 3850.00 12.01 3852.00 12.01 3854.00 12.01
3856.00 12.02 3858.00 12.02 3860.00 12.01 3862.00 12.00 3864.00 12.00 3866.00 11.98 3868.00 11.97 3870.00 11.97
3872.00 11.96 3874.00 11.96 3876.00 11.96 3878.00 11.96 3880.00 11.95
*
The National Aeronautics and Space Administration (NASA) Report CR-119 identifies an elevation of 10.97 feet at 1620 feet. This is considered a typographical error and has
been corrected in Table 1. The elevation is 10.87 feet.
BOOK 2 CS-25
TABLE 2
AMC 25.561
General
In complying with the provisions of CS 25.561(b) & (c), the loads arising from the restraint of seats and
items of equipment etc. should be taken into the structure to a point where the stresses can be
dissipated (e.g. for items attached to the fuselage floor, the load paths from the attachments through to
the fuselage primary structure should be taken into account).
Commercial accommodation equipment complying only with FAR 25.561 need additional substantiation
by analysis, tests or combination thereof to cover the 1·33 factor for their attachments as specified in
CS 25.561 (c).
AMC 25.561(d)
General
For the local attachments of seats and items of mass it should be shown by analysis and/or tests that under
the specified load conditions, the intended retaining function in each direction is still available.
1 Introduction
1.1 The contents of this AMC are considered by the Agency in determining compliance with the
damage-tolerance and fatigue requirements of CS 25.571.
1.1.2 Damage-tolerance design is required, unless it entails such complications that an effective
damage-tolerant structure cannot be achieved within the limitations of geometry, inspectability, or good
design practice. Under these circumstances, a design that complies with the fatigue evaluation (safe-
life) requirements is used. Typical examples of structure that might not be conducive to damage-
tolerance design are landing gear, engine mounts, and their attachments.
2–C–21
CS-25 BOOK 2
1.1.3 Experience with the application of methods of fatigue evaluation indicate that a test
background should exist in order to achieve the design objective. Even under the damage-tolerance
method discussed in paragraph 2, ‘Damage-tolerance (fail-safe) evaluation’, it is the general practice
within industry to conduct damage-tolerance tests for design information and guidance purposes.
Damage location and growth data should also be considered in establishing a recommended
inspection programme.
1.1.4 Assessing the fatigue characteristics of certain structural elements, such as major fittings,
joints, typical skin units, and splices, to ensure that the anticipated service life can reasonably be
attained, is needed for structure to be evaluated under CS 25.571(c).
1.2 Typical Loading Spectra Expected in Service. The loading spectrum should be based on
measured statistical data of the type derived from government and industry load history studies and,
where insufficient data are available, on a conservative estimate of the anticipated use of the
aeroplane. The principal loads that should be considered in establishing a loading spectrum are flight
loads (gust and manoeuvre), ground loads (taxiing, landing impact, turning, engine runup, braking, and
towing) and pressurisation loads. The development of the loading spectrum includes the definition of
the expected flight plan which involves climb, cruise, descent, flight times, operational speeds and
altitudes, and the approximate time to be spent in each of the operating regimes. Operations for crew
training, and other pertinent factors, such as the dynamic stress characteristics of any flexible structure
excited by turbulence, should also be considered. For pressurised cabins, the loading spectrum
should include the repeated application of the normal operating differential pressure, and the super-
imposed effects of flight loads and external aerodynamic pressures.
1.3 Components to be Evaluated. In assessing the possibility of serious fatigue failures, the
design should be examined to determine probable points of failure in service. In this examination,
consideration should be given, as necessary, to the results of stress analyses, static tests, fatigue
tests, strain gauge surveys, tests of similar structural configurations, and service experience. Service
experience has shown that special attention should be focused on the design details of important
discontinuities, main attachment fittings, tension joints, splices, and cutouts such as windows, doors
and other openings. Locations prone to accidental damage (such as that due to impact with ground
servicing equipment near aeroplane doors) or to corrosion should also be considered.
1.4 Analyses and Tests. Unless it is determined from the foregoing examination that the normal
operating stresses in specific regions of the structure are of such a low order that serious damage
growth is extremely improbable, repeated load analyses or tests should be conducted on structure
representative of components or sub-components of the wing, control surfaces, empennage, fuselage,
landing gear, and their related primary attachments. Test specimens should include structure
representative of attachment fittings, major joints, changes in section, cutouts, and discontinuities. Any
method used in the analyses should be supported, as necessary, by test or service experience.
Generally it will be required to substantiate the primary structure against the provisions of CS
25.571(b) and (c) by representative testing. The nature and extent of tests on complete structures or
on portions of the primary structure will depend upon applicable previous design and structural tests,
and service experience with similar structures. The scope of the analyses and supporting test
programmes should be agreed with the Agency.
1.5 Repeated Load Testing. In the event of any repeated load testing necessary to support the
damage tolerance or safe-life objectives of CS 25.571(b) and (c) respectively not being concluded at
the issuance of type certificate, at least one year of safe operation should be substantiated at the time
of certification. In order not to invalidate the certificate of airworthiness the fatigue substantiation
should stay sufficiently ahead of the service exposure of the lead aeroplane.
2.1 General. The damage-tolerance evaluation of structure is intended to ensure that should
serious fatigue, corrosion, or accidental damage occur within the operational life of the aeroplane, the
remaining structure can withstand reasonable loads without failure or excessive structural deformation
2–C–22
BOOK 2 CS-25
until the damage is detected. Included are the considerations historically associated with fail-safe
design. The evaluation should encompass establishing the components which are to be designed as
damage-tolerant, defining the loading conditions and extent of damage, conducting sufficient
representative tests and/or analyses to substantiate the design objectives (such as life to crack-
initiation, crack propagation rate and residual strength) have been achieved and establishing data for
inspection programmes to ensure detection of damage. Interpretation of the test results should take
into account the scatter in crack propagation rates as well as in lives to crack-initiation. Test results
should be corrected to allow for variations between the specimen and the aeroplane component
thickness and sizes. This evaluation applies to either single or multiple load path structure.
2.1.1 Design features which should be considered in attaining a damage-tolerant structure include
the following:
a. Multiple load path construction and the use of crack stoppers to control the rate of crack
growth, and to provide adequate residual static strength;
b. Materials and stress levels that, after initiation of cracks, provide a controlled slow rate of
crack propagation combined with high residual strength. For single load path discrete items, such as
control surface hinges, wing spar joints or stabiliser pivot fittings the failure of which could be
catastrophic, it should be clearly demonstrated that cracks starting from material flaws, manufacturing
errors or accidental damage (including corrosion) have been properly accounted for in the crack
propagation estimate and inspection method;
c. Arrangement of design details to ensure a sufficiently high probability that a failure in any
critical structural element will be detected before the strength has been reduced below the level
necessary to withstand the loading conditions specified in CS 25.571(b) so as to allow replacement or
repair of the failed elements; and
d. Provisions to limit the probability of concurrent multiple damage, particularly after long service,
which could conceivably contribute to a common fracture path. The achievement of this would be
facilitated by ensuring sufficient life to crack-initiation. Examples of such multiple damage are –
i. A number of small cracks which might coalesce to form a single long crack;
ii. Failures, or partial failures, in adjacent areas, due to the redistribution of loading following a
failure of a single element; and
iii. Simultaneous failure, or partial failure, of multiple load path discrete elements, working at
similar stress levels.
In practice it may not be possible to guard against the effects of multiple damage and fail-safe
substantiation may be valid only up to a particular life which would preclude multiple damage.
e. The aeroplane may function safely with an element missing. This feature would be admitted
only, provided its separation will not prevent continued safe flight and landing and the probability of
occurrence is acceptably low.
2.1.2 In the case of damage which is readily detectable within a short period (50 flights, say) for
which CS 25.571(b) allows smaller loads to be used, this relates to damage which is large enough to
be detected by obvious visual indications during walk around, or by indirect means such as cabin
pressure loss, cabin noise, or fuel leakage. In such instances, and in the absence of a probability
approach the residual load levels except for the trailing edge flaps may be reduced to not less than the
following:
a. The maximum normal operating differential pressure (including the expected external
aerodynamic pressures under 1g level flight) multiplied by a factor of 1·10 omitting other loads.
2–C–23
CS-25 BOOK 2
b. 85% of the limit flight manoeuvre and ground conditions of CS 25.571(b)(1) to (6) inclusive,
excluding (5)(ii) and separately 75% of the limit gust velocities (vertical or lateral) as specified at
speeds up to VC in CS 25.571(b)(2) and (b)(5)(i). On the other hand if the probability approach is used
the residual load levels may not in any case be lower than the values given in paragraph 2.7.2 of this
AMC for one flight exposure. In the case where fatigue damage is arrested at a readily detectable size
following rapid crack growth or a sudden load path failure under the application of high loads, the
structure must be able to withstand the loads defined in CS 25.571(b)(1) to (6) inclusive up to that size
of damage. For the subsequent growth of that damage, lower loads as stated above may be used.
2.2 Identification of Principal Structural Elements. Principal structural elements are those which
contribute significantly to carrying flight, ground, and pressurisation loads, and whose failure could
result in catastrophic failure of the aeroplane. Typical examples of such elements are as follows:
a. Control surfaces, slats, flaps and their attachment hinges and fittings;
c. Primary fittings;
d. Principal splices;
f. Skin-stringer combinations;
h. Spar webs.
2.2.2 Fuselage
b. Door frames;
d. Pressure bulkheads;
j. Window frames.
2.3 Extent of Damage. Each particular design should be assessed to establish appropriate
damage criteria in relation to inspectability and damage-extension characteristics. In any damage
determination, including those involving multiple cracks, it is possible to establish the extent of damage
in terms of detectability with the inspection techniques to be used, the associated initially detectable
crack size, the residual strength capabilities of the structure, and the likely damage-extension rate
2–C–24
BOOK 2 CS-25
considering the expected stress redistribution under the repeated loads expected in service and with
the expected inspection frequency. Thus, an obvious partial failure could be considered to be the
extent of the damage or residual strength assessment, provided a positive determination is made that
the fatigue cracks will be detectable by the available inspection techniques at a sufficiently early stage
of the crack development. In a pressurised fuselage, an obvious partial failure might be detectable
through the inability of the cabin to maintain operating pressure or controlled decompression after
occurrence of the damage. The following are typical examples of partial failures which should be
considered in the evaluation:
2.3.1 Detectable skin cracks emanating from the edge of structural openings or cutouts;
2.3.2 A detectable circumferential or longitudinal skin crack in the basic fuselage structure;
2.3.3 Complete severence of interior frame elements or stiffeners in addition to a detectable crack in
the adjacent skin;
2.3.4 A detectable failure of one element where dual construction is utilised in components such as
spar caps, window posts, window or door frames, and skin structure;
2.3.5 The presence of a detectable fatigue failure in at least the tension portion of the spar web or
similar element; and
2.3.6 The detectable failure of a primary attachment, including a control surface hinge and fitting.
2.4 Inaccessible Areas. Every reasonable effort should be made to ensure inspectability of all
structural parts, and to qualify them under the damage-tolerance provisions. In those cases where
inaccessible and uninspectable blind areas exist, and suitable damage tolerance cannot practically be
provided to allow for extension of damage into detectable areas, the structure should be shown to
comply with the fatigue (safe-life) requirements in order to ensure its continued airworthiness. In this
respect particular attention should be given to the effects of corrosion.
2.5 Testing of Principal Structural Elements. The nature and extent of tests on complete structures or
on portions of the primary structure will depend upon applicable previous design, construction, tests, and
service experience, in connection with similar structures. Simulated cracks should be as representative as
possible of actual fatigue damage. Where it is not practical to produce actual fatigue cracks, damage can
be simulated by cuts made with a fine saw, sharp blade, guillotine, or other suitable means. In those cases
where bolt failure, or its equivalent, is to be simulated as part of a possible damage configuration in joints or
fittings, bolts can be removed to provide that part of the simulation, if this condition would be representative
of an actual failure under typical load. Where accelerated crack propagation tests are made, the possibility
of creep cracking under real time pressure conditions should be recognised especially as the crack
approaches its critical length.
2.6 Identification of Locations to be Evaluated. The locations of damage to structure for damage-
tolerances evaluation should be identified as follows:
2.6.1 Determination of General Damage Locations. The location and modes of damage can be
determined by analysis or by fatigue tests on complete structures or subcomponents. However, tests
might be necessary when the basis for analytical prediction is not reliable, such as for complex
components. If less than the complete structure is tested, care should be taken to ensure that the
internal loads and boundary conditions are valid. Any tests should be continued sufficiently beyond the
expected service life to ensure that, as far as practicable, the likely locations and extent of crack
initiation are discovered.
a. If a determination is made by analysis, factors such as the following should be taken into
account:
i. Strain data on undamaged structure to establish points of high stress concentration as well as
the magnitude of the concentration;
2–C–25
CS-25 BOOK 2
iv. Design details which service experience of similarly designed components indicate are prone
to fatigue or other damage.
b. In addition, the areas of probable damage from sources such as corrosion, disbonding,
accidental damage or manufacturing defects should be determined from a review of the design and
past service experience.
2.6.2 Selection of Critical Damage Areas. The process of actually locating where damage should be
simulated in principal structural elements identified in paragraph 2.2 of this AMC should take into
account factors such as the following:
a. Review analysis to locate areas of maximum stress and low margin of safety;
b. Selecting locations in an element where the stresses in adjacent elements would be the
maximum with the damage present;
c. Selecting partial fracture locations in an element where high stress concentrations are present
in the residual structure; and
2.7 Damage-tolerance Analysis and Tests. It should be determined by analysis, supported by test
evidence, that the structure with the extent of damage established for residual strength evaluation can
withstand the specified design limit loads (considered as ultimate loads), and that the damage growth
rate under the repeated loads expected in service (between the time at which the damage becomes
initially detectable and the time at which the extent of damage reaches the value for residual strength
evaluation) provides a practical basis for development of the inspection programme and procedures
described in paragraph 2.8 of this AMC. The repeated loads should be as defined in the loading,
temperature, and humidity spectra. The loading conditions should take into account the effects of
structural flexibility and rate of loading where they are significant.
b. By demonstrating that the damage would be detected before it reaches the value for residual
strength evaluation; or
c. By demonstrating that the repeated loads and limit load stresses do not exceed those of
previously verified designs of similar configuration, materials and inspectability.
2.7.2 The maximum extent of immediately obvious damage from discrete sources should be
determined and the remaining structure shown to have static strength for the maximum load
(considered as ultimate load) expected during the completion of the flight. In the absence of a rational
analysis the following ultimate loading conditions should be covered:
i. The maximum normal operating differential pressure (including the expected external
aerodynamic pressures during 1 g level flight) multiplied by a factor 1·1 combined with 1 g flight loads.
2–C–26
BOOK 2 CS-25
ii. The aeroplane, assumed to be in 1g level flight should be shown to be able to survive the
overswing condition due to engine thrust asymmetry and pilot corrective action taking into account any
damage to the flight controls which it is presumed the aeroplane has survived.
b. Following the incident: 70% limit flight manoeuvre loads and, separately, 40% of the limit gust
velocity (vertical or lateral) as specified at VC up to the maximum likely operational speed following
failure, each combined with the maximum appropriate cabin differential pressure (including the
expected external aerodynamic pressures). Further, any loss in structural stiffness which might arise
should be shown to result in no dangerous reduction in freedom from flutter up to speed VC/MC.
2.8 Inspection. Detection of damage before it becomes dangerous is the ultimate control in
ensuring the damage-tolerance characteristics of the structure. Therefore, the applicant should
provide sufficient guidance information to assist operators in establishing the frequency, extent, and
methods of inspection of the critical structure, and this kind of information must, under CS
25.571(a)(3), be included in the maintenance manual required by CS 25.1529. Due to the inherent
complex interactions of the many parameters affecting damage tolerance, such as operating practices,
environmental effects, load sequence on crack growth, and variations in inspection methods, related
operational experience should be taken into account in establishing inspection procedures. It is
extremely important to ensure by regular inspection the detection of damage in areas vulnerable to
corrosion or accidental damage. However for crack initiation arising from fatigue alone, the frequency
and extent of the inspections may be reduced during the period up to the demonstrated crack-free life
of the part of the structure, including appropriate scatter factors (see paragraph 3.2). Comparative
analysis can be used to guide the changes from successful past practice when necessary. Therefore,
maintenance and inspection requirements should recognise the dependence on experience and should
be specified in a document that provides for revision as a result of operational experience, such as the
one containing the Manufacturers Recommended Structural Inspection Programme.
3.1 Reserved
3.2.1 General. The evaluation of structure under the following fatigue (safe-life) strength evaluation
methods is intended to ensure that catastrophic fatigue failure, as a result of the repeated loads of
variable magnitude expected in service, will be avoided throughout the structure’s operational life.
Under these methods the fatigue life of the structure should be determined. The evaluation should
include the following:
d. Determining reliable replacement times by interpreting the loading history, variable load
analyses, fatigue test data, service experience, and fatigue analysis;
e. Evaluating the possibility of fatigue initiation from sources such as corrosion, stress corrosion,
disbonding, accidental damage and manufacturing defects based on a review of the design, quality
control and past service experience; and
f. Providing necessary maintenance programmes and replacement times to the operators. The
maintenance programme should be included in Instructions for Continued Airworthiness in accordance
with CS 25.1529.
2–C–27
CS-25 BOOK 2
3.2.2 Scatter Factor for Safe-Life Determination. In the interpretation of fatigue analyses and test
data, the effect of variability should, under CS 25.571(c), be accounted for by an appropriate scatter
factor. In this process it is appropriate that the applicant justify the scatter factor chosen for any safe-
life part. The following guidance is provided (see Figure 1):
a. The base scatter factors applicable to test results are: BSF1 = 3.0, and BSF2 = (see paragraph
3.2.2(e) of this ACJ). If the applicant can meet the requirements of 3.2.2(c) of this AMC he may use
BSF1 or, at his option, BSF2.
b. The base scatter factor, BSF1, is associated with test results of one representative test
specimen.
c. Justification for use of BSF1. BSF1 may only be used if the following criteria are met:
i. Understanding of load paths and failure modes. Service and test experience of similar in-
service components that were designed using similar design criteria and methods should demonstrate
that the load paths and potential failure modes of the components are well understood.]
[ii. Control of design, material, and manufacturing process quality. The applicant should
demonstrate that his quality system (e.g. design, process control, and material standards) ensures the
scatter in fatigue properties is controlled, and that the design of the fatigue critical areas of the part
account for the material scatter.
A. The test article should be full scale (component or sub-component) and represent that portion
of the production aircraft requiring test. All differences between the test article and production article
should be accounted for either by analysis supported by test evidence or by testing itself.
B. Construction details, such as bracket attachments, clips, etc., should be accounted for, even
though the items themselves may be non-load bearing.
C. Points of load application and reaction should accurately reflect those of the aircraft, ensure
correct behaviour of the test article, and guard against uncharacteristic failures.
D. Systems used to protect the structure against environmental degradation can have a negative
effect on fatigue life and therefore should be included as part of the test article.
d. Adjustments to base scatter factor BSF1. Having satisfied the criteria of paragraph 3.2.2(c),
justifying the use of BSF1, the base value of 3.0 should be adjusted to account for the following
considerations, as necessary, where not wholly taken into account by design analysis. As a result of
the adjustments, the final scatter factor may be less than, equal to, or greater than 3.0.
ii. Spectrum severity. Test load spectrum should be derived based on a spectrum sensitive
analysis accounting for variations in both utilisation (i.e. aircraft weight, cg etc.) and occurrences / size
of loads. The test loads spectrum applied to the structure should be demonstrated to be conservative
when compared to the usage expected in service.
iii. Number of representative test specimens. Well established statistical methods should be used
that associate the number of items tested with the distribution chosen, to obtain an adjustment to the
base scatter factor.
e. If the applicant cannot satisfy the intent of all of paragraph 3.2.2(c) of this AMC, BSF2 should
be used.
2–C–28
BOOK 2 CS-25
i. The applicant should propose scatter factor BSF2 based on careful consideration of the
following issues: the required level of safety, the number of representative test specimens, how
representative the test is, expected fatigue scatter, type of repeated load test, the accuracy of the test
loads spectrum, spectrum severity, and the expected service environmental conditions.
f. Resolution of test loadings to actual loadings. The applicant may use a number of different
approaches to reduce both the number of load cycles and number of test set-ups required. Due to the
modifications to the flight-by-flight loading sequence, the applicant should propose either analytical or
empirical approaches to quantify an adjustment to the number of test cycles which represents the
difference between the test spectrum and assumed flight-by-flight spectrum. In addition, an adjustment
to the number of test cycles may be justified by raising or lowering the test load levels as long as
appropriate data support the applicant’s position. Other effects to be considered are different failure
locations, different response to fretting conditions, temperature effects, etc. The analytical approach
should use well established methods or be supported by test evidence.
2–C–29
CS-25 BOOK 2
1
Have the criteria of 3.2.2(c) been met:
- service and test experience of similar
components,
- QA system ensuring fatigue scatter lies
within certain limits,
- representativeness of test specimen
2 3
All criteria met Some criteria missed
10
?
4 5
Use BSF1=3.0 Use BSF2 ≥ 3.0
7
BSF2 determined from analysis and test:
- Required level of safety
6
- Number of specimens tested
Have the elements of 3.2.2(d) been
- Representativeness of test
accounted for in design:
- Fatigue scatter to account for P=99%
- Fatigue scatter to account for P=99%
and C=95%
and C=95%
- Type of repeated load test
- Spectrum severity
- Accuracy of test load spectrum
- Spectrum severity
- Service environmental conditions
8 9 MINIMUM VALUE ≥ 3.0
All elements Some elements Adjust BSF2 for resolution of test loads to
met missed actual loads.
11 14
? Safe Life = Test cycles / Adjusted BSF
15 13
Adjust BSF1 for: Adjust BSF1 for:
- Number of specimens - Fatigue scatter
tested - Spectrum severity
- Resolution of test - Number of specimens
loads to actual loads tested
- Resolution of test loads
to actual loads
16
Safe Life = Test cycles / Adjusted BSF
Figure 1
2–C–30
BOOK 2 CS-25
3.3 Replacement Times. Replacement times should be established for parts with established
safe-lives and should, under CS 25.571(a)(3), be included in the information prepared under CS
25.1529. These replacement times can be extended if additional data indicates an extension is
warranted. Important factors which should be considered for such extensions include, but are not
limited to, the following:
3.3.2 Recorded Load and Stress Data. Recorded load and stress data entails instrumenting
aeroplanes in service to obtain a representative sampling of actual loads and stresses experienced.
The data to be measured includes airspeed, altitude, and load factor versus time data; or airspeed,
altitude and strain ranges versus time data; or similar data. This data, obtained by instrumenting
aeroplanes in service, provides a basis for correlating the estimated loading spectrum with the actual
service experience;
3.3.3 Additional Analyses and Tests. If test data and analyses based on repeated load tests of
additional specimens are obtained, a re-evaluation of the established safe-life can be made;
3.3.4 Tests of Parts Removed from Service. Repeated load tests of replaced parts can be utilised to
re-evaluate the established safe-life. The tests should closely simulate service loading conditions.
Repeated load testing of parts removed from service is especially useful where recorded load data
obtained in service are available since the actual loading experienced by the part prior to replacement
is known; and
3.3.5 Repair or Rework of the Structure. In some cases, repair or rework of the structure can gain
further life.
3.4 Type Design Developments and Changes. For design developments, or design changes,
involving structural configurations similar to those of a design already shown to comply with the
applicable provisions of CS 25.571(c), it might be possible to evaluate the variations in critical portions
of the structure on a comparative basis. Typical examples would be redesign of the wing structure for
increased loads, and the introduction in pressurised cabins of cutouts having different locations or
different shapes, or both. This evaluation should involve analysis of the predicted stresses of the
redesigned primary structure and correlation of the analysis with the analytical and test results used in
showing compliance of the original design with CS 25.571(c).
In the above mentioned conditions the dynamic effects are included except that if significant changes
in stiffness and/or geometry follow from the failure or partial failure the response should be further
investigated.
AMC 25.581
Lightning Protection
b. So designed and/or protected that a lightning discharge to the part (e.g. a radio aerial) will
cause only local damage which will not endanger the aeroplane or its occupants.
2–C–31
CS-25 BOOK 2
1.2 In addition, where internal linkages are connected to external parts (e.g. control surfaces), the
linkages should be bonded to main earth or airframe by primary bonding paths as close to the external
part as possible.
1.3 Where a primary conductor provides or supplements the primary bonding path across an
operating jack (e.g. on control surfaces or nose droop) it should be of such an impedance and so
designed as to limit to a safe value the passage of current through the jack.
1.4 In considering external metal parts, consideration should be given to all flight configurations
(e.g. lowering of landing gear and wing-flaps) and also the possibility of damage to the aeroplane
electrical system due to surges caused by strikes to protuberances (such as pitot heads) which have
connections into the electrical system.
a. They are provided with effective lightning diverters which will safely carry the lightning
discharges described in EUROCAE document ED-84 (including Amendment N°1 dated 06/09/99) titled
: Aircraft Lightning Environment and Related Test Waveforms, or equivalent SAE ARP5412 document.
b. Damage to them by lightning discharges will not endanger the aeroplane or its occupants, or
c. A lightning strike on the insulated portion is improbable because of the shielding afforded by
other portions of the aeroplane.
Where lightning diverters are used the surge carrying capacity and mechanical robustness of
associated conductors should be at least equal to that required for primary conductors.
2.2 Where unprotected non-metallic parts are fitted externally to the aeroplane in situations where
they may be exposed to lightning discharges (e.g. radomes) the risks include the following:
a. The disruption of the materials because of rapid expansion of gases within them (e.g. water
vapour),
b. The rapid build up of pressure in the enclosures provided by the parts, resulting in mechanical
disruption of the parts themselves or of the structure enclosed by them,
c. Fire caused by the ignition of the materials themselves or of the materials contained within the
enclosures, and
d. Holes in the non-metallic part which may present a hazard at high speeds.
2.3 The materials used should not absorb water and should be of high dielectric strength in order
to encourage surface flash-over rather than puncture. Laminates made entirely from solid material are
preferable to those incorporating laminations of cellular material.
2.4 Those external non-metallic part which is not classified as primary structure should be
protected by primary conductors.
2.5 Where damage to an external non-metallic part which is not classified as primary structure
may endanger the aeroplane, the part should be protected by adequate lightning diverters.
2.6 Confirmatory tests may be required to check the adequacy of the lightning protection provided
(e.g. to confirm the adequacy of the location and size of bonding strips on a large radome.)
2–C–32
BOOK 2 CS–25
AMC – SUBPART D
1 Purpose. This AMC sets forth an acceptable means, but not the only means, of showing
compliance with the provisions of CS–25 regarding airworthiness type certification requirements for
composite aircraft structures, involving fibre-reinforced materials, e.g. carbon (graphite), boron, aramid
(Kevlar), and glass-reinforced plastics. Guidance information is also presented on associated quality
control and repair aspects.
This AMC material is identical, apart from minor editing, to the structural content of FAA Advisory
Circular AC 20.107A, dated 25 April 1984.
The individual CS paragraphs applicable to each AMC paragraph are listed in Table 1 of this AMC.
2 Definitions
2.1 Design values. Material, structural element, and structural detail properties that have been
determined from test data and chosen to assure a high degree of confidence in the integrity of the
completed structure (see CS 25.613(b)).
2.2 Allowables. Material values that are determined from test data at the laminate or lamina level
on a probability basis (e.g. A or B base values).
2.3 Laminate level design values or allowables. Established from multi-ply laminate test data
and/or from test data at the lamina level and then established at the laminate level by test validated
analytical methods.
2.4 Lamina level material properties. Established from test data for a single-ply or multi-ply
single-direction oriented lamina lay-up.
2.5 Point design. An element or detail of a specific design which is not considered generically
applicable to other structure for the purpose of substantiation (e.g. lugs and major joints). Such a
design element or detail can be qualified by test or by a combination of test and analysis.
2.7 Degradation. The alteration of material properties (e.g. strength, modulus, coefficient of
expansion) which may result from deviations in manufacturing or from repeated loading and/or
environmental exposure.
2.8 Discrepancy. A manufacturing anomaly allowed and detected by the planned inspection
procedure. They can be created by processing, fabrication or assembly procedures.
2-D-1
CS–25 BOOK 2
2.12 Coupon. A small test specimen (e.g. usually a flat laminate) for evaluation of basic lamina or
laminate properties or properties of generic structural features (e.g. bonded or mechanically fastened
joints).
2.13 Element. A generic element of a more complex structural member (e.g. skin, stringers, shear
panels, sandwich panels, joints, or splices).
2.14 Detail. A non-generic structural element of a more complex member (e.g. specific design
configured joints, splices, stringers, stringer runouts, or major access holes).
2.15 Subcomponent. A major three-dimensional structure which can provide complete structural
representation of a section of the full structure (e.g. stub-box, section of a spar, wing panel, wing rib,
body panel, or frames).
2.16 Component. A major section of the airframe structure (e.g. wing, body, fin, horizontal
stabiliser) which can be tested as a complete unit to qualify the structure.
3 General
3.1 This AMC is published to aid the evaluation of certification programmes for composite
applications and reflects the current status of composite technology. It is expected that this AMC will
be modified periodically to reflect technology advances.
3.2 The extent of testing and /or analysis and the degree of environmental accountability required
will differ for each structure depending upon the expected service usage, the material selected, the
design margins, the failure criteria, the data base and experience with similar structures, and on other
factors affecting a particular structure. It is expected that these factors will be considered when
interpreting this AMC for use on a specific application.
4.1 To provide an adequate design data base, environmental effects on the design properties of
the material system should be established.
4.2 Environmental design criteria should be developed that identify the most critical environmental
exposures, including humidity and temperature, to which the material in the application under
evaluation may be exposed. This is not required where existing data demonstrate that no significant
environmental effects, including the effects of temperature and moisture, exist for material systems and
construction details, within the bounds of environmental exposure being considered. Experimental
evidence should be provided to demonstrate that the material design values or allowables are attained
with a high degree of confidence in the appropriate critical environmental exposures to be expected in
service. The effect of the service environment on static strength, fatigue and stiffness properties
should be determined for the material system through tests (e.g. accelerated environmental tests, or
from applicable service data). The effects of environmental cycling (i.e. moisture and temperature)
should be evaluated. Existing test data may be used where it can be shown directly applicable to the
material system.
4.3 The material system design values or allowables should be established on the laminate level
by either test of the laminate or by test of the lamina in conjunction with a test-validated analytical
method.
4.4 For a specific structural configuration of an individual component (point design), design values
may be established which include the effects of appropriate design features (holes, joints, etc.).
4.5 Impact damage is generally accommodated by limiting the design strain level.
2–D–2
BOOK 2 CS–25
5.1 The static strength of the composite design should be demonstrated through a programme of
component ultimate load tests in the appropriate environment, unless experience with similar designs,
material systems and loadings is available to demonstrate the adequacy of the analysis supported by
subcomponent tests, or component tests to agreed lower levels.
5.2 The effects of repeated loading and environmental exposure which may result in material
property degradation should be addressed in the static strength evaluation. This can be shown by
analysis supported by test evidence, by tests at the coupon, element or subcomponent level, or
alternatively by relevant existing data.
5.3 Static strength structural substantiation tests should be conducted on new structure unless the
critical load conditions are associated with structure that has been subjected to repeated loading and
environmental exposure. In this case either –
a. The static test should be conducted on structure with prior repeated loading and environmental
exposure, or
5.4 The component static test may be performed in an ambient atmosphere if the effects of the
environment are reliably predicted by subcomponent and/or coupon tests and are accounted for in the
static test or in the analysis of the results of the static test.
5.5 The static test articles should be fabricated and assembled in accordance with production
specifications and processes so that the test articles are representative of production structure.
5.6 When the material and processing variability of the composite structure is greater than the
variability of current metallic structures, the difference should be considered in the static strength
substantiation by –
a. Deriving proper allowables or design values for use in the analysis, and the analysis of the
results of supporting tests, or
b. Accounting for it in the static test when static proof of structure is accomplished by component
test.
5.7 Composite structures that have high static margins of safety may be substantiated by analysis
supported by subcomponent, element and/or coupon testing.
5.8 It should be shown that impact damage that can be realistically expected from manufacturing
and service, but not more than the established threshold of detectability for the selected inspection
procedure, will not reduce the structural strength below ultimate load capability. This can be shown by
analysis supported by test evidence, or by tests at the coupon, element or subcomponent level.
6.1 The evaluation of composite structure should be based on the applicable requirements of CS
25.571. The nature and extent of analysis or tests on complete structures and/or portions of the primary
structure will depend upon applicable previous fatigue/damage tolerant designs, construction, tests,
and service experience on similar structures. In the absence of experience with similar designs,
approved structural development tests of components, subcomponents, and elements should be
performed. The following considerations are unique to the use of composite material systems and
should be observed for the method of substantiation selected by the applicant. When selecting the
damage tolerance or safe life approach, attention should be given to geometry, inspectability, good
design practice, and the type of damage/degradation of the structure under consideration.
2-D-3
CS–25 BOOK 2
6.2.1 Structural details, elements, and subcomponents of critical structural areas should be tested
under repeated loads to define the sensitivity of the structure to damage growth. This testing can form
the basis for validating a no-growth approach to the damage tolerance requirements. The testing
should assess the effect of the environment on the flaw growth characteristics and the no-growth
validation. The environment used should be appropriate to the expected service usage. The repeated
loading should be representative of anticipated service usage. The repeated load testing should
include damage levels (including impact damage) typical of those that may occur during fabrication,
assembly, and in service, consistent with the inspection techniques employed. The damage tolerance
test articles should be fabricated and assembled in accordance with production specifications and
processes so that the test articles are representative of production structure.
6.2.2 The extent of initially detectable damage should be established and be consistent with the
inspection techniques employed during manufacture and in service. Flaw/damage growth data should
be obtained by repeated load cycling of intrinsic flaws or mechanically introduced damage. The
number of cycles applied to validate a no-growth concept should be statistically significant, and may be
determined by load and/or life considerations. The growth or no growth evaluation should be
performed by analysis supported by test evidence, or by tests at the coupon, element or subcomponent
level.
6.2.3 The extent of damage for residual strength assessments should be established. Residual
strength evaluation by component or subcomponent testing or by analysis supported by test evidence
should be performed considering that damage. The evaluation should demonstrate that the residual
strength of the structure is equal to or greater than the strength required for the specified design loads
(considered as ultimate). It should be shown that stiffness properties have not changed beyond
acceptable levels. For the no-growth concept, residual strength testing should be performed after
repeated load cycling.
6.2.4 An inspection programme should be developed consisting of frequency, extent, and methods
of inspection for inclusion in the maintenance plan. Inspection intervals should be established such
that the damage will be detected between the time it initially becomes detectable and the time at which
the extent of damage reaches the limits for required residual strength capability. For the case of no-
growth design concept, inspection intervals should be established as part of the maintenance
programme. In selecting such intervals the residual strength level associated with the assumed
damage should be considered.
6.2.5 The structure should be able to withstand static loads (considered as ultimate loads) which are
reasonably expected during the completion of the flight on which damage resulting from obvious
discrete sources occur (i.e. uncontained engine failures, etc.). The extent of damage should be based
on a rational assessment of service mission and potential damage relating to each discrete source.
6.2.6 The effects of temperature, humidity, and other environmental factors which may result in
material property degradation should be addressed in the damage tolerance evaluation.
2–D–4
BOOK 2 CS–25
demonstrated during the fatigue tests that the stiffness properties have not changed beyond
acceptable levels. Replacement lives should be established based on the test results. An appropriate
inspection programme should be provided.
7 Proof of Structure – Flutter. The effects of repeated loading and environmental exposure on
stiffness, mass and damping properties should be considered in the verification of integrity against
flutter and other aeroelastic mechanisms. These effects may be determined by analysis supported by
test evidence, or by tests of the coupon, element or subcomponent level.
8 Additional Considerations
8.1 Impact Dynamics. The present approach in airframe design is to assure that occupants have
every reasonable chance of escaping serious injury under realistic and survivable impact conditions.
Evaluation may be by test or by analysis supported by test evidence. Test evidence includes, but is
not limited to, element or subcomponent tests and service experience. Analytical comparison to
conventional structure may be used where shown to be applicable.
8.4 Protection of Structure. Weathering, abrasion, erosion, ultraviolet radiation, and chemical
environment (glycol, hydraulic fluid, fuel, cleaning agents, etc.) may cause deterioration in a composite
structure. Suitable protection against and/or consideration of degradation in material properties should
be provided for and demonstrated by test.
8.5 Quality Control. An overall plan should be established and should involve all relevant
disciplines (i.e. engineering, manufacturing and quality control). This quality control plan should be
responsive to special engineering requirements that arise in individual parts or areas as a result of
potential failure modes, damage tolerance and flaw growth requirements, loadings, inspectability, and
local sensitivities to manufacture and assembly.
9.1 For composite structures a change of material is defined as any of the following situations
(even though the structural design remains unchanged).
b. The same basic constituents but any change of the impregnation method.
9.2 For any material change the showing of compliance with CS 25.603 should cover AMC
paragraphs 9.2.1 to 9.2.5 in detail.
2-D-5
CS–25 BOOK 2
9.2.1 The nature and extent of the material change should be clearly defined.
9.2.2 Substantiation should be based on a comparability study between the structural performances
of the material accepted for type certification and the replacement material. An acceptable approach
would be to select from the original substantiating testing those tests that are to be repeated and to
justify the omission of others. The extent of testing required will depend on the airworthiness
significance of the part and the nature of the material change.
9.2.3 Pass/fail targets should be established as part of the test programme. Any properties that
show a significant change in the replacement material should be given special consideration.
9.2.4 The test substantiation selected should interrogate the critical failure modes of the component.
9.2.5 Design allowables should be established to the same level of statistical confidence for the
replacement material.
TABLE 1
8 Additional Considerations
2–D–6
BOOK 2 CS–25
TABLE 1 (continued)
2-D-7
CS–25 BOOK 2
1 PURPOSE
This Acceptable Means of Compliance (AMC) provides guidance for the re-certification of composite
structures that, in production, use a different material from that proposed and substantiated at the time
of certification of the original structure. Like all advisory material, this document is not, in itself,
mandatory and does not constitute a regulation. It is issued to provide guidance and to outline an
acceptable method of showing compliance with CS 25.603.
2 SCOPE
The AMC only addresses already certificated composite structures where there is no change to the
design and use other than the material change. Components that have a change in geometry or design
loading may need to be addressed in a different way.
3 BACKGROUND
The showing of compliance of a new material with CS 25.603, as an alternative to the previously
selected material, should normally involve the following steps:
The problem with composites is much more complex than with metallic materials, because their
performance is much more process dependant. So, until we are capable of accurately identifying the key
material parameters governing processability, there will be a need for tests directly interrogating material
performance through specimens representative of the actual design details of the composite structure.
Today, showing the suitability of a composite material for its anticipated use, requires a large amount
of test data ranging from the coupon level to specimens representative of the most complex features of
the structure design. The time needed to perform all these tests and the associated costs are the
reasons why, in most cases, only one material can be proposed for type certification.
Such diversity of testing is required with composites because these materials develop their mechanical
properties only when the component is processed (or at least, the resin cured) i.e. that the design of
the structure and the associated production processes govern these properties.
To give a more technical interpretation of this specific character of composites, it is necessary to go back to
the general principles for dimensioning a structure. Theoretically the strength of a structure could be
calculated with analytical models capable, from the knowledge of relevant material properties, of
anticipating the mechanical behaviour of complex design details. Unfortunately with composites these
analytical models are still insufficiently precise at the level of failure prediction and require a step by step
testing verification with more and more complex specimens (the ‘pyramid’ approach).
Moreover, as the design and the associated manufacturing process can affect the eventual properties,
the failure modes along with composite failure prediction models can vary from one material to another.
Consequently, they both need to be examined for any material change.
‘In house’ composite material ‘qualification’ procedures developed by every manufacturer involve
specifications covering:
2-D-8
BOOK 2 CS–25
But interchangeability for a structural application is not guaranteed between two materials meeting the
same manufacture specification (as it could be for materials that are much less process dependant,
metallic materials for instance). Under these circumstances, a material that meets the ‘qualification’
required by a specification does not necessarily produce satisfactory components.
C– Same material but modification of the processing route (if the modification to the processing
route governs eventual composite mechanical properties):
– curing cycle,
– tooling,
– lay-up method,
– environmental parameters of the laying room.
A classification is to be made between a new material which is intended to be a replica of the former
one (cases ‘B’ or ‘C’) and a ‘truly new material’ (case ‘A’). So, two classes are proposed:
Within the ‘identical materials’ class, a sub-classification can be made between a change of the
prepregging machine alone at the supplier and licensed production elsewhere. For the time being, a
change to a new fibre produced under a licensed process and reputed to be a replica of the former
one, will be dealt with as an ‘alternative material’.
Some changes within this class may not interact with structural performances (e.g. prepreg release
papers, some bagging materials etc..) and should not be submitted to an agency approval. However
the manufacturers (or the supplier) should develop a proper system for screening those changes, with
adequate proficiency at all relevant decision levels.
Case ‘A’ (alternative material) should always be considered as an important change. It is not
recommended to try a sub-classification according to the basic constituents being changed, as material
behaviour (e.g. sensitivity to stress concentrations) may be governed by interfacial properties which
may be affected either by a fibre or a resin change.
5 SUBSTANTIATION METHOD
Only the technical aspects of substantiation are addressed here.
a. Compliance philosophy
Substantiation should be based on a comparability study between the structural performances of the
material accepted for type certification, and the second material.
Whatever the modification proposed for a certificated item, the revised margins of safety should remain
adequate. Any reduction in the previously demonstrated margin should be investigated in detail.
2-D-9
CS–25 BOOK 2
– allowables and design values, whatever the level of investigation; material or design, should
remain valid,
– calculation models – including failure prediction should remain the same,
– the technical content of the procurement specification (case ‘B’) should not be changed.
– new allowables and design values for all relevant properties should be determined,
– analytical models, including failure prediction models, should be reviewed and, if necessary,
substantiated by tests,
– the procurement specification should be evaluated (or a new specification suited to the
selected material should be defined) to ensure control quality variations are adequately
controlled,
– example changing from 1st to 2nd generation of carbon fibres may improve tensile strength
properties by more than 20%: so keeping the same acceptability threshold in the process
specification would not allow the detection of quality variations.
b. Tests to be performed
The pyramid of tests (building block approach) illustrated in Figure 1 is a consistent way to prepare and
present structural substantiation for approval. Each stage of this pyramid refers to an investigation
level in terms of specimen category (coupon, element, detail, sub-component and component) as they
are defined in the AMC No. 1 to CS 25.603. Coupons and elements are generic specimens which form
the data base and can be common to several pyramids. The non-generic specimens (detail, sub-
component, component) are specific to each composite item.
As a first approach, the investigation level might be restricted to the generic specimens for an identical
material, but for an alternative material non-generic ones should be included.
Typically, substantiation should always cover the inherent structural behaviour of composites. The test
programme should be established considering the material change proposed and the airworthiness
significance of the part. An example list of tests is given in Table 1.
This table applies also for a change in the process route Case C. In some instances (e.g. a cure cycle
change) possible consequences can be assessed by tests on generic specimens only. For other
changes like those involving tooling (e.g. from a full bag process to thermo-expansive cores) the
assessment should include an evaluation of the component itself (sometimes called the ‘tool proof
test’). In this case, an expanded non destructive inspection procedure should be required for the first
items to be produced. This should be supplemented – if deemed necessary – by ‘cut up’ specimens
from a representative component, for physical or mechanical investigations.
c. Number of batches
The purpose for testing a number of batches is the demonstration of an acceptable reproducibility of
material characteristics. The number of batches required should take into account:
2-D-10
BOOK 2 CS–25
d. Pass/Fail Criteria
Target pass/fail criteria should be established as part of the test programme. As regards strength
considerations for instance, a statistical analysis of test data should demonstrate that new allowables
derived for the second material provide an adequate margin of safety. Therefore, provision should be
made for a sufficient number of test specimens to allow for such analysis. At the non-generic level,
when only one test article is used to assess a structural feature, the pass criteria should be a result
acceptable with respect to design ultimate loads. In the cases where test results show lower margins
certification documentation will need to be revised.
e. Other considerations
For characteristics other than strength (all those listed in AMC No. 1 to CS 25.603, paragraphs 7 and
8) the substantiation should also ensure an equivalent level of safety.
2-D-11
CS–25 BOOK 2
2-D-12
BOOK 2 CS–25
AMC 25.603(b)
Approved Material Specifications
Approved material specifications can be for example industry or military specifications, or European
Technical Standard Orders.
2-D-13
CS–25 BOOK 2
AMC 25.607
Fasteners
FAA Advisory Circular AC 20-71 Dual Locking Devices on Fasteners, date 12-8-70, is accepted by the
Agency as providing acceptable means of compliance with CS 25.607.
AMC 25.609
Protection of Structure
The comprehensive and detailed material standards accepted in the member states will be accepted
as satisfying the requirement of CS 25.609.
AMC 25.631
Bird Strike Damage
Consideration should be given in the early stages of the design to the installation of items in essential
services, such as control system components, and items which, if damaged, could cause a hazard,
such as electrical equipment. As far as practicable, such items should not be installed immediately
behind areas liable to be struck by birds.
AMC 25.671(a)
Control Systems – General
Control systems for essential services should be so designed that when a movement to one position
has been selected, a different position can be selected without waiting for the completion of the initially
selected movement, and the system should arrive at the finally selected position without further
attention. The movements which follow and the time taken by the system to allow the required
sequence of selection should not be such as to adversely affect the airworthiness of the aeroplane.
AMC 25.671(b)
Control Systems – General
For control systems which, if incorrectly assembled, would hazard the aeroplane, the design should be
such that at all reasonably possible break-down points it is mechanically impossible to assemble
elements of the system to give –
a. An out-of-phase action,
c. Interconnection of the controls between two systems where this is not intended.
Only in exceptional circumstances should distinctive marking of control systems be used to comply with
the above.
AMC 25.671(c)(1)
Control Systems – General
2-D-14
BOOK 2 CS–25
However, where a single component is used on the basis that its failure is extremely improbable, it
should comply with CS 25.571(a) and (b).
AMC 25.672(c)(1)
Stability Augmentation and Automatic and Power-operated Systems
The severity of the flying quality requirement should be related to the probability of the occurrence in a
progressive manner such that probable occurrences have not more than minor effects and improbable
occurrences have not more than major effects.
AMC 25.679(a)(2)
Control System Gust Locks
If the device required by CS 25.679(a) limits the operation of the aeroplane by restricting the
movement of a control that must be set before take-off (e.g. throttle control levers), this device should
be such that it will perform the function for which it is designed even when subject to likely
maladjustment or wear, so that –
a. The movement of that control is restricted as long as the device is engaged; and
AMC 25.679(b)
Control System Gust Locks
For the purposes of meeting the design intent of this paragraph, flight means the time from the moment
the aircraft first moves under its own power for the purpose of flight until the moment it comes to rest
after landing.
AMC 25.685(a)
Control System Details
In assessing compliance with CS 25.685(a) account should be taken of the jamming of control circuits
by the accumulation of water in or on any part which is likely to freeze. Particular attention should be
paid to the following:
b. Components in parts of the aeroplane which could be contaminated by the water systems of
the aeroplane in normal or fault conditions; if necessary such components should be shielded.
c. Components in parts of the aeroplane where rain and/or condensed water vapour can drip or
accumulate.
d. Components inside which water vapour can condense and water can accumulate.
2-D-15
CS–25 BOOK 2
AMC 25.701(d)
Flap and slat interconnection
FAA Advisory Circular AC 25-14 High Lift and Drag Devices, dated 5-4-88, is accepted by the Agency
as providing acceptable means of compliance with CS 25.701(d).
AMC 25.703
Take-off Configuration Warning Systems
1. PURPOSE. This AMC provides guidance for the certification of take-off configuration warning
systems installed in large aeroplanes. Like all AMC material, this AMC is not mandatory and does not
constitute a requirement. It is issued to provide guidance and to outline a method of compliance with
the rules.
2. RELATED REQUIREMENTS.
CS 25.703, 25.1301, 25.1309, 25.1322, 25.1357, 25.1431, and 25.1529.
3. RELATED MATERIAL.
(1) Advisory Circular 25.1309-( ), System Design and Analysis and AC 25-11 Transport
Category Airplane Electronic Display Systems. Advisory circulars can be obtained from the U.S.
Department of Transportation, M-443.2, Subsequent Distribution Unit, Washington, D.C. 20590.
(3) FAA report, Review of Take-off Configuration Warning Systems on Large Jet Transports,
dated April 29, 1988. This document can be obtained from the Federal Aviation Administration,
Transport Airplane Directorate, 1601 Lind Avenue, S.W., Renton, Washington, 98055-4056.
b. Industry Documents.
(1) Aerospace Recommended Practice (ARP) 450D, Flight Deck Visual, Audible and Tactile
Signals; ARP 4012/4, Flight Deck Alerting Systems (FAS). These documents can be obtained from the
Society of Automotive Engineers, Inc. (SAE), 400 Commonwealth Drive, Warrendale, Pennsylvania
15096.
(3) ARINC 726, Flight Warning Computer System. This document can be obtained from the
ARINC, 2551 Riva Road, Annapolis, Maryland 21401.
4. BACKGROUND. A number of aeroplane accidents have occurred because the aeroplane was not
properly configured for take-off and a warning was not provided to the flight crew by the take-off
2-D-16
BOOK 2 CS–25
configuration warning system. Investigations of these accidents have indicated a need for guidance
material for design and approval of take-off configuration warning systems.
5. DISCUSSION.
a. Regulatory Basis.
(1) CS 25.703, "Take-off warning system," requires that a take-off configuration warning
system be installed in large aeroplanes. This requirement was introduced with JAR-25 Amendment 5
effective 1.1.79. On the FAR side, this was added to Part 25 by Amendment 25-42 effective on March
1, 1978. CS 25.703 requires that a take-off warning system be installed and provide an aural warning
to the flight crew during the initial portion of the take off roll, whenever the aeroplane is not in a
configuration which would allow a safe take-off. The intent of this rule is to require that the take-off
configuration warning system cover (a) only those configurations of the required systems which would
be unsafe, and (b) the effects of system failures resulting in wrong surface or system functions if there
is not a separate and adequate warning already provided. According to the preamble of Amendment
25-42, the take-off warning system should serve as "back-up for the checklist, particularly in unusual
situations, e.g., where the checklist is interrupted or the take-off delayed." Conditions for which
warnings are required include wing flaps or leading edge devices not within the approved range of
take-off positions, and wing spoilers (except lateral control spoilers meeting the requirements of CS
25.671), speed brakes, parking brakes, or longitudinal trim devices in a position that would not allow a
safe take-off. Consideration should also be given to adding rudder trim and aileron (roll) trim if these
devices can be placed in a position that would not allow a safe take-off.
(2) Prior to CS-25 Amendment 5 and FAR 25 Amendment 25-42, there was no requirement for
a take-off configuration warning system to be installed in large aeroplanes. Since this amendment is
not retroactive, some large aeroplane models in service today may not have take-off configuration
warning systems; however, all large turbojet transports currently in service, even those with a
certification basis established prior to 1978, include a take-off configuration warning system in the
basic design. These include the majority of large aeroplanes.
(3) Other general rules such as CS 25.1301, 25.1309, 25.1322, 25.1357 and 25.1431 for
electronic system installations also apply to take-off configuration warning systems.
b. System Criticality.
(1) It has been Aviation Authorities policy to categorise systems designed to alert the flight
crew of potentially hazardous operating conditions as being at a level of criticality associated with a
probable failure condition. (For a definition of this terminology together with discussions and guidelines
on the classification of failure conditions and the probability of failures, see AMC 25.1309). This is
because failures of these systems, in themselves, are not considered to create an unsafe condition,
reduce the capability of the aeroplane, or reduce the ability of the crew to cope with adverse operating
conditions. Other systems which fall into this category include stall warning systems, overspeed
warning systems, ground proximity warning systems, and windshear warning systems.
(2) Even though AMC 25.1309 does not define an upper probability limit for probable failure
conditions, generally, it can be shown by analysis that such systems have a probability of failure (of the
ability to adequately give a warning) which is approximately 1.0 x 10E-3 or less per flight hour. This
probability does not take into account the likelihood that a warning will be needed. Systems which are
designed to meet this requirement are usually single channel systems with limited built-in monitoring.
Maintenance or pre-flight checks are relied on to limit the exposure time to undetected failures which
would prevent the system from operating adequately.
(3) Applying the practice given in sub-paragraphs b(1) and b(2) above to take-off configuration
warning systems is not considered to result in an adequate level of safety when the consequence of
the combination of failure of the system and a potentially unsafe take-off configuration could result in a
major/catastrophic failure condition. Therefore, these systems should be shown to meet the criteria of
AMC 25.1309 pertaining to a major failure condition, including design criteria and in-service
2-D-17
CS–25 BOOK 2
maintenance at specified intervals. This will ensure that the risk of the take-off configuration warning
system being unavailable when required to give a warning, if a particular unsafe configuration occurs,
will be minimised.
(4) If such systems use digital electronic technology, a software level should be used, in
accordance with the applicable version of EUROCAE ED-12/RTCA document DO-178, which is
compatible with the system integrity determined by the AMC 25.1309 analysis.
(5) Since a false warning during the take-off run at speeds near V1 may result in an
unnecessary rejected take-off (RTO), which could lead to a mishap, the occurrence of a false warning
during the take-off should be remote in accordance with AMC 25.1309.
(6) If the take-off configuration warning system is integrated with other systems that provide
crew alerting functions, the level of criticality of common elements should be commensurate with that
of the take-off configuration warning system unless a higher level is dictated by one or more of the
other systems.
c. Design Considerations.
(1) A review of existing take-off configuration warning systems has shown a trend towards
increased sophistication of design, partly due to the transition towards digital electronic technology
which is amenable to self-monitoring and simple testing. The net result has been an improvement in
reliability, fewer unwanted warnings and enhanced safety.
(2) With the objective of continuing this trend, new systems should be designed using the
objectives and criteria of AMC 25.1309. Analysis should include all the remote sensors, transducers
and the elements they depend on, as well as any take-off configuration warning system line
replaceable unit (LRU) and the actual visual and aural warning output devices.
(3) Unwanted warnings may be reduced by inhibiting the take-off configuration warning
system where it is safer to do so, e.g., between V1 and VR, so that a hazardous rejected take-off is not
attempted. Inhibition of the take-off configuration warning system at high speeds will also avoid any
confusion from the occurrence of a warning during a touch-and-go landing. This is because the basic
message of an alert is to stop because it is unsafe to take off. It may or may not tell the flight crew
which surface or system is wrong. A warning may be more hazardous than reliance on the flight crew's
skill and training to cope with the situation.
(4) Even though CS 25.703 specifies those inputs common to most large aeroplanes that must
be included in the design, each aeroplane model should be carefully reviewed to ascertain that any
configuration or trim setting that could jeopardise a safe take-off has an input to the take-off warning
system unless a separate and adequate warning is already provided by another system. There may be
aeroplane configurations or electronically positioned lateral or longitudinal trim unique to a particular
model that constitute this hazard. In the event that it is necessary to inhibit the warning from a
particular system during the entire take-off roll, an equivalent level of safety finding would be required.
(5) Automatic volume adjustment should be provided to maintain the aural warning volume at
an appropriate level relative to cockpit ambient sound. According to Report No. DOT/FAA/RD-81/38, II
entitled "Aircraft Alerting Systems Standardisation Study, Volume II - Aircraft Alerting System Design
Guidelines," aural signals should exceed masked threshold by 8 ± 3 dB.
(6) Of particular importance in the design of take-off configuration warning systems is the
elimination of nuisance warnings. These are warnings generated by a system which is functioning as
designed but which are inappropriate or unnecessary for the particular phase of operation. Attempting
to eliminate nuisance warnings cannot be overemphasised because any indication which could cause
the flight crew to perform a high speed rejected take-off, or which distracts or adversely affects the
flight crew's performance of the take-off manoeuvre, creates a hazard which could lead to an accident.
In addition, any time there are nuisance warnings generated, there is a possibility that the flight crew
2-D-18
BOOK 2 CS–25
will be tempted to eliminate them through system deactivation, and by continually doing this, the flight
crew may be conditioned to ignore a valid warning.
(7) There are a number of operations that could produce nuisance warnings. Specifically,
single engine taxi for twin engine aeroplanes, or in the case of 3 and 4 engine aeroplanes, taxi with
fewer than all engines operating is a procedure used by some operators for the purpose of saving fuel.
Nuisance warnings have also been caused by trim changes and speed brake handle adjustments.
(8) The means for silencing the aural warning should not be located such that it can be
operated instinctively, inadvertently, or by habitual reflexive action. Silencing is defined as the
interruption of the aural warning. When silenced, it is preferred that the system will be capable of re-
arming itself automatically prior to take-off . However, if there is a clear and unmistakable annunciation
that the system is silenced, manual re-arming is acceptable.
(9) Each aeroplane model has a different means of arming the take-off configuration warning
system, therefore the potential for nuisance warnings varies accordingly. Some existing systems use
only a single throttle position, some use position from multiple throttles, some use EPR or N1, and
some use a combination of these. When logic from a single operating engine was used, nuisance
warnings were common during less than all engine taxi operations because of the higher power
settings required to move the aeroplane. These systems were not designed for that type of operation.
Because this procedure is used, inputs that arm the system should be judiciously selected taking into
account any likely combination of operating and shut-down engines so that nuisance warnings will not
occur if the aeroplane is not in take-off configuration.
(10) CS 25.703 requires only an aural alert for the take-off warning system. CS 25.1322
currently specify requirements for visual alerts while related reading material reference 3a(2), 3a(4)
and 3b(1) provide guidance for integrated visual and aural annunciations for warnings, cautions and
advisory alerting conditions. It has been common industry practice to incorporate the above mentioned
references in their aeroplane designs. FAR/CS 25.1322 are planned for revision to incorporate the
guidance of these references to reflect current industry practices. Manufacturers may wish to
incorporate these alerting concepts to the take-off warning system. If such is the case , the following
guidance is offered:
a) A master warning (red) attention getting alert may be provided in the pilot's primary field of view
simultaneously with the aural attention getting alert.
b) In addition to or instead of the aural attention getting alert (tone), voice may be used to specify the
general problem (Configuration), or the exact problem (slats, flaps, trim, parking brake, etc…).
c) The visual alert may also specify the general problem (Configuration), or the exact problem(slats,
flaps, trim, parking brake, etc…).
d) A visual cautionary alert associated with the failure of the Take-off warning system may be provided
e.g. "T/O WARN FAIL".
(11) The EASA Agency approved Master Minimum Equipment List (MMEL) includes those
items of equipment related to airworthiness and operating regulations and other items of equipment
which the Agency finds may be inoperative and yet maintain an acceptable level of safety by
appropriate conditions and limitations. No MMEL relief is provided for an inoperative take-off
configuration warning. Therefore, design of these systems should include proper system monitoring
including immediate annunciation to the flight crew should a failure be identified or if power to the
system is interrupted.
(1) When manual tests or checks are required to show compliance with CS 25.1309, by
detecting the presence of and limiting the exposure time to a latent failure that would render the
warning inoperative, they should be adequate, simple and straight forward in function and interval to
allow a quick and proper check by the flight crew and maintenance personnel. Flight crew checks may
be specified in the approved Aeroplane Flight Manual (AFM) and, depending on the complexity of the
take-off configuration warning system and the aeroplane, maintenance tasks may be conventional
Maintenance Review Board (MRB) designed tasks or listed as Certification Check Requirements
2-D-19
CS–25 BOOK 2
(CCR) where appropriate, as defined in AMC 25.1309, and determined as part of the approval process
between the manufacturer and the certification office.
(2) The specified tests/checks established in accordance with sub-paragraph 5d(1) above
should be demonstrated as part of the approval process and should show that each input sensor as
well as the control and logic system and its emitters, including the indication system, are individually
verified as required to meet sub-paragraph 5b(3). It should also be demonstrated that the warning self
cancels when required to do so, for example by retarding the throttles or correcting the wrong
configuration.
e. Test Considerations.
(1) During flight testing it should be shown that the take-off configuration warning system does
not issue nuisance alerts or interfere with other systems. Specific testing should be conducted to
ensure that the take-off configuration warning system works satisfactorily for all sensor inputs to the
system. Flight testing should include reconfiguration of the aeroplane during touch and go
manoeuvres.
(2) It should be shown by test or analysis that for all requested power settings, feasible
weights, taxiway slopes, temperatures and altitudes, there will be no nuisance warnings, nor failure to
give a warning when necessary (e.g., cold conditions, derated take-off), for any reasonable
configuration of engines operating or shut down. This is to test or simulate all expected operational
configurations. Reasonable pilot technique for applying power should be presumed.
(3) The means for silencing the aural warning by the flight crew will be evaluated to assure
that the device is not accessible instinctively and it is properly protected from inadvertent activation.
Automatic or manual re-arming of the warning system will be evaluated.
AMC 25.723
Shock Absorption Tests
1. PURPOSE. This AMC sets forth an acceptable means, but not the only means, of demonstrating
compliance with the provisions of CS-25 related to the use of landing gear shock absorption tests and
analyses to determine landing loads for large aeroplanes.
2. RELATED CS PARAGRAPHS. CS 25.723 "Shock absorption tests" and CS 25.473 "Landing load
conditions and assumptions."
a. Validation of the landing gear characteristics. Shock absorption tests are necessary to validate the
analytical representation of the dynamic characteristics of the landing gear unit that will be used to
determine the landing loads. A range of tests should be conducted to ensure that the analytical model
is valid for all design conditions. In addition, consideration should be given to ensuring that the range
of test configurations is sufficient for justifying the use of the analytical model for foreseeable future
growth versions of the aeroplane.
b. Recommended test conditions for new landing gear units. The design takeoff weight and the
design landing weight conditions should both be included as configurations subjected to energy
absorption tests. However, in cases where the manufacturer has supporting data from previous
experience in validating the analytical model using landing gear units of similar design concept, it may
be sufficient to conduct tests of the new landing gear at only the condition associated with maximum
energy. The landing gear used to provide the supporting data may be from another model aircraft but
should be of approximately the same size with similar components.
2-D-20
BOOK 2 CS–25
c. Changes to type designs. CS 25.723(c) allows changes in previously approved design weights and
minor changes in design to be substantiated by analyses based on tests of the same basic landing
gear unit with similar energy absorption characteristics.
A landing gear unit would be considered to be of “the same basic landing gear system” when the
design concept has not been changed. “Similar energy absorption characteristics” means that the
changes to the landing gear unit, either taken individually or as a whole, would not have a significant
effect on the validation of the analytical results for the modified aeroplane. Changes that may be
acceptable without further energy absorption tests include minor changes and adjustments
incorporated in the landing gear unit to maintain similar energy absorption characteristics with changes
in design weight and landing speeds.
For example, the following changes may be acceptable without further tests:
(1) Minor changes in shock absorber details including pre-load, compression ratio, orifice sizes,
metering pin profiles.
(2) Minor changes in tyre characteristics.
(3) Minor changes in unsprung mass (e.g. brakes).
(4) Local strengthening or minor sizing changes to the landing gear.
To allow justification by analysis for the reserve energy requirement, neither the shock strut nor the
tyres should bottom during the reserve energy analysis or the tests upon which the analysis is
correlated.
a. Compliance with CS 25.723(a) may be shown by free drop tests, provided they are made on the
complete aeroplane, or on units consisting of a wheel, tyre, and shock absorber, in their proper
positions, from free drop heights not less than--
(1) 475 mm (18.7 inches) for the design landing weight conditions; and
(2) 170 mm (6.7 inches) for the design takeoff weight conditions.
b. If aeroplane lift is simulated by air cylinders or by other mechanical means, the weight used for the
drop must be equal to W. If the effect of aeroplane lift is represented in free drop tests by a reduced
weight, the landing gear must be dropped with an effective weight equal to
h + (1 − L)d
We = W
h+d
where:
c. The drop test attitude of the landing gear unit and the application of appropriate drag loads during
the test must simulate the aeroplane landing conditions in a manner consistent with the development of
rational or conservative limit loads.
2-D-21
CS–25 BOOK 2
d. The value of d used in the computation of We in paragraph 4.(b) of this AMC may not exceed the
value actually obtained in the drop test.
a. Compliance with the reserve energy absorption condition specified in CS 25.723(b) may be shown
by free drop tests provided the drop height is not less than 69 cm (27 inches).
b. If aeroplane lift is simulated by air cylinders or by other mechanical means, the weight used for the
drop must be equal to W. If the effect of aeroplane lift is represented in free drop tests by an
equivalent reduced weight, the landing gear must be dropped with an effective weight:
Wh
We =
h + d
where the symbols and other details are the same as in paragraph 4 above.
AMC 25.729(e)
Retracting Mechanism
a. A green light for each unit is illuminated only when the unit is secured in the correct landing
position.
b. A warning light consistent with CS 25.1322 is illuminated at all times except when the landing
gear and its doors are secured in the landing or retracted position.
2 The warning required by CS 25.729(e)(2) should preferably operate whatever the position of
wing leading- or trailing-edge devices or the number of engines operating.
3 The design should be such that nuisance activation of the warning is minimised, for example –
a. When the landing gear is retracted after a take-off following an engine failure, or during a take-
off when a common flap setting is used for take-off and landing;
c. When flying at low altitude in clean or low speed configuration (special operation).
4 Inhibition of the warning above a safe altitude out of final approach phase either automatically
or by some other means to prevent these situations is acceptable, but it should automatically reset for
a further approach.
5 Means to de-activate the warning required by CS 25.729(e) may be installed for use in
abnormal or emergency conditions provided that it is not readily available to the flight crew, i.e. the
control device is protected against inadvertent actuation by the flight crew and its de-activated state is
obvious to the flight crew.
2-D-22
BOOK 2 CS–25
AMC 25.729(f)
Protection of Equipment on Landing Gear and in Wheel Wells
The use of fusible plugs in the wheels is not a complete safeguard against damage due to tyre
explosion.
Where brake overheating could be damaging to the structure of, or equipment in, the wheel wells, an
indication of brake temperature should be provided to warn the pilot.
AMC 25.735
Brakes and Braking Systems Certification Tests and Analysis
1. PURPOSE
This AMC (Acceptable Means of Compliance) which is similar to the FAA Advisory Circular AC
25.735-1 provides guidance material for use as an acceptable means, although not the only means, of
demonstrating compliance with the requirements of CS 25.731 and CS 25.735. It also identifies other
paragraphs of the EASA Certification Specifications (CS) that contain related requirements and other
related and complementary documents.
IR-21 and CS-25 paragraphs (and their associated AMC material where applicable) that prescribe
requirements related to the design substantiation and certification of brakes and braking systems
include:
Additional IR-21 and CS-25 paragraphs (and their associated AMC material where applicable) that
prescribe requirements which can have a significant impact on the overall design and configuration of
brakes and braking systems are, but are not limited to:
2-D-23
CS–25 BOOK 2
b. Complementary Documents
Documents that provide appropriate standards for the design substantiation and certification of Brakes
and Braking Systems are, but are not limited to:
ARP 597C Wheels and Brakes, Supplementary Criteria for Design Endurance - Civil
Transport Aircraft
ARP 813A Maintainability Recommendations for Aircraft Wheels and Brakes
AIR 1064B Brake Dynamics
ARP 1070B Design and Testing of Anti-skid Brake Control Systems for Total Aircraft
Compatibility
AS 1145A Aircraft Brake Temperature Monitor System (BTMS)
ARP 1619 Replacement and Modified Brakes and Wheels
AIR 1739 Information on Anti-skid Systems
ARP 1907 Automatic Braking Systems Requirements
AIR 1934 Use of Carbon Heat Sink Brakes on Aircraft
ARP 4102/2 Automatic Braking System (ABS)
ARP 4752 Aerospace - Design and Installation of Commercial Transport Aircraft
Hydraulic Systems
(Note: This document provides a wide range of Civil, Military and Industry
document references and standards which may be appropriate.)
ISO 7137 Environmental Conditions and Test Procedures for Airborne Equipment.
2-D-24
BOOK 2 CS–25
3. RESERVED
4. DISCUSSION
(1) CS 25.735(a) states that each assembly consisting of a wheel(s) and brake(s) must be
approved. Each wheel and brake assembly fitted with each designated and approved tyre type and
size, where appropriate, should be shown to be capable of meeting the minimum standards and
capabilities detailed in the applicable European Technical Standard Order (E)TSO, in conjunction with
the type certification procedure for the aeroplane, or by any other means approved by the Agency. This
applies equally to replacement, modified, and refurbished wheel and brake assemblies or components,
whether the changes are made by the Original Equipment Manufacturer (OEM) or others. Additionally,
the components of the wheels, brakes, and braking systems should be designed to:
(a) Withstand all pressures and loads, applied separately and in conjunction, to which they
may be subjected in all operating conditions for which the aeroplane is certificated.
(b) Withstand simultaneous applications of normal and emergency braking functions, unless
adequate design measures have been taken to prevent such a contingency.
(c) Meet the energy absorption requirements without auxiliary cooling devices (such as cooling
fans).
(d) Not induce unacceptable vibrations at any likely ground speed and condition or any
operating condition (such as retraction or extension).
(e) Protect against the ingress or effects of foreign bodies or materials (water, mud, oil, and
other products) that may adversely affect their satisfactory performance. Following initial aeroplane
certification, any additional wheel and brake assemblies should meet the applicable airworthiness
requirements specified in IR 21.101(a) and (b) to eliminate situations that may have adverse
consequences on aeroplane braking control and performance. This includes the possibility of the use
of modified brakes either alone (i.e., as a ship set) or alongside the OEM’s brakes and the mixing of
separately approved assemblies.
(3) Replacement and Modified Equipment. Replacement and modified equipment includes
changes to any approved wheel and brake assemblies not addressed under paragraph 4a(2) of this
AMC. Consultation with the aeroplane manufacturer on the extent of testing is recommended.
Particular attention should be paid to potential differences in the primary brake system parameters
(e.g., brake torque, energy capacity, vibration, brake sensitivity, dynamic response, structural strength,
and wear state). If comparisons are made to previously approved equipment, the test articles (other
than the proposed parts to be changed) and conditions should be comparable, as well as the test
procedures and equipment on which comparative tests are to be conducted. For wheel and brake
assembly tests, the tyre size, manufacturer, and ply rating used for the test should be the same and
the tyre condition should be comparable. For changes of any heat sink component parts, structural
parts (including the wheel), and friction elements, it is necessary to provide evidence of acceptable
performance and compatibility with the aeroplane and its systems.
2-D-25
CS–25 BOOK 2
(a) Minor Changes. Changes to a brake might be considered as a minor change, as long as
the changes are not to the friction elements. The proposed change cannot affect the aeroplane
stopping performance, brake energy absorption characteristics, and/or continued airworthiness of the
aeroplane or wheel and brake assembly (e.g., vibration and/or thermal control, and brake retraction
integrity). Technical evidence justifying a minor change should be provided.
(b) Major Changes. Changes to a wheel assembly outside the limits allowed by the OEM’s
CMM should be considered a major change due to potential airworthiness issues.
(c) Past history with friction elements has indicated the necessity of ongoing monitoring (by
dynamometer test) of frictional and energy absorption capabilities to assure that they are maintained
over the life of the aeroplane program. These monitoring plans have complemented the detection and
correction of unacceptable deviations. A monitoring plan should be submitted to the cognisant
Certification Office to ensure continued airworthiness of the product.
(d) Intermixing of wheel and brake assemblies from different suppliers is generally not
acceptable due to complexities experienced with different friction elements, specific brake control
tuning, and other factors.
(1) The system should be designed so that no single failure of the system degrades the aeroplane
stopping performance beyond doubling the braked roll stopping distance (refer to CS 25.735(b)(1)).
Failures are considered to be fracture, leakage, or jamming of a component in the system, or loss of an
energy source. Components of the system include all parts that contribute to transmitting the pilot's braking
command to the actual generation of braking force. Multiple failures resulting from a single cause should be
considered a single failure (e.g., fracture of two or more hydraulic lines as a result of a single tyre failure).
Sub-components within the brake assembly, such as brake discs and actuators (or their equivalents),
should be considered as connecting or transmitting elements, unless it is shown that leakage of hydraulic
fluid resulting from failure of the sealing elements in these sub-components within the brake assembly
would not reduce the braking effectiveness below that specified in CS 25.735(b)(1).
(a) In order to meet the stopping distance requirements of CS 25.735(b)(1) in the event of
failure of the normal brake system, it is common practice to provide an alternate brake system. The
normal and alternate braking systems should be independent, being supplied by separate power
sources. Following a failure of the normal system, the changeover to a second system (whether
manually or by automatic means) and the functioning of a secondary power source should be effected
rapidly and safely. The changeover should not involve risk of wheel locking, whether the brakes are
applied or not at the time of changeover.
(b) The brake systems and components should be separated or appropriately shielded so that
complete failure of the braking system(s) as a result of a single cause is minimised.
(a) Showing that fluid released would not impinge on the brake, or any part of the assembly
that might cause the fluid to ignite;
(c) Showing that the maximum amount of fluid released is not sufficient to sustain a fire.
(3) Additionally, in the case of a fire, it may be shown that the fire is not hazardous, taking into
consideration such factors as landing gear geometry, location of fire sensitive (susceptibility)
equipment and installations, system status, flight mode, etc.
If more than one fluid is allowed for the hydraulic system, compliance should be addressed for all
fluids.
2-D-26
BOOK 2 CS–25
(1) The braking force should increase or decrease progressively as the force or movement
applied to the brake control is increased or decreased (refer to CS 25.735(c)(1)). The braking force
should respond to the control as quickly as is necessary for safe and satisfactory operation. A brake
control intended only for parking need not operate progressively. There should be no requirement to
select the parking brake “off” in order to achieve a higher braking force with manual braking.
(2) When an automatic braking system is installed (refer to CS 25.735(c)(2)) such that various
levels of braking (e.g., low, medium, high) may be preselected to occur automatically following a
touchdown, the pilot(s) should be provided with a means that is separate from other brake controls to
arm and/or disarm the system prior to the touchdown.
(3) The automatic braking system design should be evaluated for integrity and non-hazard,
including the probability and consequence of insidious failure of critical components, and non
interference with the non-automatic braking system. Single failures in the automatic braking system
should not compromise non-automatic braking of the aeroplane. Automatic braking systems that are to
be approved for use in the event of a rejected take-off should have a single selector position, set prior
to take-off, enabling this operating mode.
It should be demonstrated that the parking brake has sufficient capability in all allowable operating
conditions (Master Minimum Equipment List (MMEL) to be able to prevent the rotation of braked wheels.
This demonstration is to be accomplished with the stated engine power settings, and with the aeroplane
configuration (i.e., ground weight, c.g., position and nose-wheel (or tail-wheel) angle) least likely to result in
skidding on a dry, level runway surface (refer to CS 25.735(d)). Use of ground idle thrust on the “other”
engine is not mandatory, higher thrust levels may be used to prevent aeroplane motion due to the
asymmetric engine thrust. Where reliable test data are available, substantiation by means other than
aeroplane testing may be acceptable.
(1) For compliance with the requirement for indication that the parking brake is not fully
released, the indication means should be associated, as closely as is practical, with actual application
of the brake rather than the selector (control). The intent is to minimise the possibility of false indication
due to failures between the brake and the point at which the parking brake state is sensed. This
requirement is separate from, and in addition, to the parking brake requirements associated with CS
25.703(a)(3), Take-off warning systems.
(2) The parking brake control, whether or not it is independent of the emergency brake control,
should be marked with the words "Parking Brake" and should be constructed in such a way that, once
operated, it can remain in the selected position without further flight crew attention. It should be located
where inadvertent operation is unlikely, or be protected by suitable means against inadvertent
operation.
(1) If an anti-skid system is installed (refer to CS 25.735(e)), then no single failure in the anti-
skid system should result in the brakes being applied, unless braking is being commanded by the pilot.
In the event of an anti-skid system failure, means should be available to allow continued braking
without anti-skid. These means may be automatic, pilot controlled, or both.
(a) Failures that render the system ineffective should not prevent manual braking control by the
pilot(s) and should normally be indicated. Failure of wheels, brakes, or tyres should not inhibit the
function of the anti-skid system for unaffected wheel, brake, and tyre assemblies.
(b) The anti-skid system should be capable of giving a satisfactory braking performance over
2-D-27
CS–25 BOOK 2
the full range of tyre to runway friction coefficients and surface conditions, without the need for pre-
flight or pre-landing adjustments or selections. The range of friction coefficients should encompass
those appropriate to dry, wet, and contaminated surfaces and for both grooved and ungrooved
runways.
(c) The use of the phrase “without external adjustment” is intended to imply that once the anti-
skid system has been optimised for operation over the full range of expected conditions for which the
aeroplane is to be type certificated, pre-flight or pre-landing adjustments made to the equipment to
enable the expected capabilities to be achieved are not acceptable. For example, a specific pre-
landing selection for a landing on a contaminated low µ (friction level) runway, following a take-off from
a dry high µ runway, should not be necessary for satisfactory braking performance to be achieved.
(d) It should be shown that the brake cycling frequency imposed by the anti-skid installation will
not result in excessive loads on the landing gear. Anti-skid installations should not cause surge
pressures in the brake hydraulic system that would be detrimental to either the normal or emergency
brake system and components.
(e) The system should be compatible with all tyre sizes and type combinations permitted and for all
allowable wear states of the brakes and tyres. Where brakes of different types or manufacture are
permitted, compatibility should be demonstrated or appropriate means should be employed to ensure that
undesirable combinations are precluded.
(f) The anti-skid function must be able to reduce braking for a wheel/tyre that is going into a
skid, whether the braking level is commanded by the pilot or an auto-brake system if installed.
The kinetic energy capacity of each tyre, wheel, and brake assembly should be at least equal to that part of
the total aeroplane energy that the assembly will absorb during a stop, with the heat sink at a defined
condition at the commencement of the stop (Refer to CS 25.735(f)).
(a) The design landing stop, the maximum kinetic energy accelerate-stop, and the most severe
landing stop brake kinetic energy absorption requirements of each wheel and brake assembly should
be determined using either of the following methods:
(i) A conservative rational analysis of the sequence of events expected during the braking
manoeuvre; or
(ii) A direct calculation based on the aeroplane kinetic energy at the commencement of the
braking manoeuvre.
(b) When determining the tyre, wheel, and brake assembly kinetic energy absorption
requirement using the rational analysis method, the analysis should use conservative values of the
aeroplane speed at which the brakes are first applied, the range of the expected coefficient of friction
between the tyres and runway, aerodynamic and propeller drag, powerplant forward thrust, and, if
more critical, the most adverse single engine or propeller malfunction.
(c) When determining the tyre, wheel, and brake assembly energy absorption requirement
using the direct calculation method, the following formula, which needs to be modified in cases of
designed unequal braking distribution, should be used:
2-D-28
BOOK 2 CS–25
(d) For all cases, V is the ground speed and takes into account the prevailing operational
conditions. All approved landing flap conditions should be considered when determining the design
landing stop energy.
(e) These calculations should account for cases of designed unequal braking distributions.
“Designed unequal braking distribution” refers to unequal braking loads between wheels that result
directly from the design of the aeroplane. An example would be the use of both main-wheel and nose-
wheel brakes, or the use of brakes on a centreline landing gear supporting lower vertical loads per
braked wheel than the main landing gear braked wheels. It is intended that this term should account for
effects such as runway crown. Crosswind effects need not be considered.
(f) For the design landing case, the aeroplane speed should not be less than VREF/1.3, where
VREF is the aeroplane steady landing approach speed at the maximum design landing weight and in the
landing configuration at sea level. Alternatively, the aeroplane speed should not be less than VSO, the
power-off stall speed of the aeroplane at sea level, at the design landing weight, and in the landing
configuration.
(g) For the most severe landing case, the effects and consequences of typical single and
multiple failure conditions that are foreseeable events and can necessitate landings at abnormal
speeds and weights should be addressed. The critical landing weight for this condition is the maximum
take-off weight, less fuel burned and jettisoned during a return to the departure airfield. A 30-minute
flight should be assumed, with 15 minutes of active fuel jettisoning if equipped with a fuel jettisoning
system.
(a) For the maximum kinetic energy accelerate-stop case, the calculation should account for:
(ii) The effects of braking during taxi-in, the temperature change while parked,
(iv) The additional temperature change during the take-off acceleration phase, up to the time of
brake application.
(b) The analysis may not take account of auxiliary cooling devices. Assessment of ambient
conditions within the operational limits established by the applicant and the typical time the aeroplane
will be on the ground should be used.
(c) For the most severe landing stop case, the same temperature conditions and changes used
for the maximum kinetic energy accelerate-stop case should be assumed, except that further
temperature change during the additional flight phase may be considered.
(d) The brake temperature at the commencement of the braking manoeuvre should be
determined using the rational analysis method. However, in the absence of such analysis, an arbitrary
heat sink temperature should be used equal to the normal ambient temperature, increased by the
amount that would result from a 10 percent maximum kinetic energy accelerate-stop for the accelerate-
2-D-29
CS–25 BOOK 2
stop case and from a 5 percent maximum kinetic energy accelerate-stop for landing cases.
(3) Substantiation.
(a) Substantiation is required to show that the wheel and brake assembly is capable of
absorbing the determined levels of kinetic energy at all permitted wear states up to and including the
declared fully worn limits. The term “wear state" is used to clarify that consideration should be given to
possible inconsistencies or irregularities in brake wear in some circumstances, such as greater wear at
one end of the heat sink than the other end. Qualification related to equally distributed heat sink wear
may not be considered adequate. If in-service wear distribution is significantly different from wear
distribution used during qualification testing, additional substantiation and/or corrective action may be
necessary.
(b) The minimum initial brakes-on speed used in the dynamometer tests should not be more
than the velocity (V) used in the determination of the kinetic energy requirements of CS 25.735(f). This
assumes that the test procedure involved a specific rate of deceleration and, therefore, for the same
amount of kinetic energy, a higher initial brakes-on speed would result in a lower rate of energy
absorption. Such a situation is recognised and is similarly stated in (E)TSO-C135, which provides an
acceptable means for brake approval under CS 25.735(a).
(c) For certification purposes, a brake having a higher initial brakes-on speed is acceptable if
the dynamometer test showed that both the energy absorbed and the energy absorption rates required
by CS 25.735(f) had been achieved.
(d) Brake qualification tests are not intended as a means of determining expected aeroplane
stopping performance, but may be used as an indicator for the most critical brake wear state for
aeroplane braking performance measurements.
g. Ref. CS 25.735(g) Brake Condition after High Kinetic Energy Dynamometer Stop(s)
(1) Following the high kinetic energy stop(s), the parking brake should be capable of
restraining further movement of the aeroplane and should maintain this capability for the period during
which the need for an evacuation of the aeroplane can be determined and then fully accomplished. It
should be demonstrated that, with a parking brake application within a period not exceeding 20
seconds of achieving a full stop, or within 20 seconds from the time that the speed is retarded to 37
km/h (20 knots) (or lower), in the event that the brakes are released prior to achieving a full stop (as
permitted by (E)TSO-C135), the parking brake can be applied normally and that it remains functional
for at least 3 minutes.
(2) Practical difficulties associated with dynamometer design may preclude directly
demonstrating the effectiveness of the parking brake in the period immediately following the high
energy dynamometer stop(s). Where such difficulties prevail, it should be shown that, for the 3-minute
period, no structural failure or other condition of the brake components occurs that would significantly
impair the parking brake function.
(3) Regarding the initiation of a fire, it should be demonstrated that no continuous or sustained
fire, extending above the level of the highest point of the tyre, occurs before the 5-minute period has
elapsed. Neither should any other condition arise during this same period or during the stop, either
separately or in conjunction with a fire, that could be reasonably judged to prejudice the safe and
complete aeroplane evacuation. Fire of a limited extent and of a temporary nature (e.g., those involving
wheel bearing lubricant or minor oil spillage) is acceptable. For this demonstration, neither fire-fighting
means nor coolants may be applied.
(1) Stored energy systems use a self-contained source of power, such as a pressurised
hydraulic accumulator or a charged battery (refer to CS 25.735(h)). This requirement is not applicable
for those aeroplanes that provide a number of independent braking systems, including a stored energy
2-D-30
BOOK 2 CS–25
system, but are not "reliant" on the stored energy system for the demonstration of compliance with CS
25.735(b).
(a) The minimum energy level necessary to meet the requirements of CS 25.735(b)(1) and (h)
(i.e., the acceptable level for dispatch of the aeroplane);
(c) The energy level below which further brake application may not be possible.
(3) If a gas pressurised hydraulic accumulator is to be used as the energy storage means,
indication of accumulator pressure alone is not considered adequate means to indicate available
stored energy, unless verification can be made of the correct pre-charge pressure with the hydraulic
system pressure off and the correct fluid volume with the hydraulic system pressure on. Furthermore,
additional safeguards may be necessary to ensure that sufficient energy will be available at the end of
the flight. Similar considerations should be made if other stored energy systems are used.
(4) A full brake application cycle is defined as an application from brakes fully released to
brakes fully applied, and back to fully released.
The indication means should be located such that no special tool or illumination (except in
darkness) is required. Expert interpretation of the indication should not be necessary (refer to CS
25.735(i)).
(1) The temperature sensitive devices (e.g., fuse or fusible plugs) should be sufficient in
number and appropriately located to reduce the tyre pressure to a safe level before any part of the
wheel becomes unacceptably hot, irrespective of the wheel orientation. The devices should be
designed and installed so that once operated (or triggered) their continued operation is not impaired by
the releasing gas. The effectiveness of these devices in preventing hazardous tyre blow-out or wheel
failure should be demonstrated. It should also be demonstrated that the devices will not release the
tyre pressure prematurely during take-off and landing, including during “quick turnaround” types of
operation.
(2) It should be shown that the over-pressurisation devices, or the devices in conjunction with
the tyre inflation means permanently installed in the wheel, would not permit the tyre pressure to reach
an unsafe level regardless of the capacity of the inflation source.
(3) Both types of devices should normally be located within the structure of the wheel in
positions that minimise the risk of damage or tampering during normal maintenance.
(1) As part of the overall substantiation of safe and anomaly free operation, it is necessary to
2-D-31
CS–25 BOOK 2
show that no unsafe conditions arise from incompatibilities between the brakes and brake system with
other aeroplane systems and structures. Areas that should be explored include anti-skid tuning,
landing gear dynamics, tyre type and size, brake combinations, brake characteristics, brake and
landing gear vibrations, etc. Similarly, wheel and tyre compatibility should be addressed. These issues
should be readdressed when the equipment is modified.
(2) During brake qualification testing, sufficient dynamometer testing over the ranges of
permissible brake wear states, energy levels, brake pressures, brake temperatures, and speeds should
be undertaken to provide information necessary for systems integration.
AMC 25.735(f)
Brakes
For determination of the design landing brake kinetic energy capacity rating, the initial condition of the
brakes may be selected and can be any condition representative of service use, including new, and
which satisfies the applicable ETSO or other acceptable brake qualification test standard.
AMC 25.745(a)
Nose-wheel Steering
In a powered nose-wheel steering system the normal supply for steering should continue without
interruption in the event of failure of any one power-unit. With the remaining power-units operating at
ground idling condition, the power supply should be adequate –
b. To complete a landing manoeuvre following a power-unit failure which occurs during take-off or
at any later stage of flight.
AMC 25.745(c)
Nose-wheel Steering
2 In assessing where the inadvertent application of steering torque as a result of a single failure
would lead to danger, allowance may be made for the pilot’s instinctive reaction to the effects of the
fault. However, dependent on the urgency and rapidity of warning of the failure given to the pilot,
allowance should be made for a reaction time before it is assumed that the pilot takes any corrective
action.
AMC 25.773(b)(1)(ii)
Pilot Compartment View
For windshields protected by the application of electrical heat, a nominal heating capacity of 70 W/dm2
would be adequate.
2-D-32
BOOK 2 CS–25
AMC 25.775(d)
Windshields and Windows
1. PURPOSE. This AMC sets forth an acceptable means, but not the only means, of demonstrating
compliance with the provisions of CS-25 pertaining to the certification requirements for windshields,
windows, and mounting structure. Guidance information is provided for showing compliance with
CS 25.775(d), relating to structural design of windshields and windows for aeroplanes with pressurised
cabins.
2. RELATED CS PARAGRAPHS.
3. DEFINITIONS.
a. Annealed glass. Glass that has had the internal stresses reduced to low values by heat treatment
to a suitable temperature and controlled cooling.
b. Chemically toughened glass. Annealed glass immersed in a bath of molten salt resulting in an ion
exchange between the salt and the glass. The composition of the salt is such that this ion exchange
causes the surface of the glass to be distorted (expansion), thus putting the surface in a state of
compression.
c. Creep. The change in dimension of a material under load over a period of time, not including the
initial instantaneous elastic deformation. The time dependent part of strain resulting from an applied
stress.
f. Mounting. The structure that attaches the panel to the aircraft structure.
g. Notch sensitive. The extent to which the sensitivity of a material to fracture is increased by the
presence of a surface non-homogeneity, such as a notch, a sudden change in cross section, a crack,
or a scratch. Low notch sensitivity is usually associated with ductile materials, and high notch
sensitivity is usually associated with brittle materials.
i. Panel. The panel is the complete windshield or window excluding the mounting.
j. Thermally toughened glass. Annealed glass heated to its softening temperature after which the
outer surfaces are rapidly cooled in a quenching medium resulting in the outer surface being put into a
state of compression with the core material in tension to maintain equilibrium.
k. Toughened glass. Annealed glass placed into a state of compressive residual stress, with the
internal bulk in a compensating tensile stress. Toughening may be achieved by either thermal or
chemical processes.
2-D-33
CS–25 BOOK 2
characteristics of these materials require special engineering solutions for aircraft windshield and
window panel designs.
a. Glass. In general, glass has good resistance to scratching and chemical attack, such as wiper
action, solvents, and de-icing fluid. Windshield and window panel designs, however, should take into
account its other unique properties, which are considerably different from metals.
(1) Glass exhibits no sharp change in physical properties when heated or cooled and has no
definite melting point.
(2) Unlike metals, glass is a hard brittle material that does not exhibit plastic deformation.
(3) Glass is much stronger in compression than in tension. Fracture will occur, under any form of
loading, when the induced deformation causes the tensile stress to exceed the Modulus of Rupture
(MOR).
(4) The strength of glass varies with the rate of loading; the faster the rate of loading the higher
the strength, as is the case for bird impact loading. In addition, glass fracture stress for a load of short
duration will substantially exceed that for a sustained load.
(5) The strength of glass, whether annealed or toughened, can be reduced by edge and surface
damage such as scratches, chips, and gouges. Failure is usually initiated at some point of mechanical
damage on the surface. However, thermal or chemical toughening can considerably increase the
fracture strength of annealed glass.
(6) Safety factors necessary on glass components. The safety factors necessary for glass
components are significantly higher than for other materials used in aircraft construction because of:
the loss of strength with duration of load, the variability in strength inherent in glass, and the thickness
tolerances and high notch sensitivity.
(a) Thermally toughened glass. The surface of annealed glass may be placed in a state of
compression by heating the glass to its softening temperature after which the outer surfaces are
rapidly cooled in a quenching medium. As mentioned, this results in the outer surface being put into a
state of compression with the core material in tension to maintain equilibrium. The surface compressive
layer in thermally toughened glass is approximately 18 percent of the total thickness of the glass.
There are limitations on the minimum thickness of glass that can be effectively toughened by thermal
processing. Very thin glass can not be effectively toughened by these methods. In general, toughening
can increase the MOR of a piece of glass by approximately 3.5 to 20 times. Thermally toughened glass
has significant stored energy within it. This energy is released to a certain extent when the glass
fractures. Generally, the higher the stored energy the smaller particles are on fracture. Since thermal
toughening leaves the glass with high compressive stresses in its surfaces, all cutting, grinding, or
shaping must be done before toughening.
2-D-34
BOOK 2 CS–25
b. Polymethyl-methacrylate (acrylic). The acrylic materials used for aircraft transparent structural
panels are unplasticised methyl-methacrylate based polymers. There are two basic forms of acrylic
materials used in aircraft windshield and window panels, as-cast and biaxially stretched (stretched from
a cross-linked base material).
(1) As-cast acrylic material: Forming acrylic material to a certain shape by pouring it into a mould
and letting it harden without applying external pressure. Although not as notch sensitive as glass,
unstretched acrylics have a notch sensitivity. This unplasticised methyl-methacrylate base polymer has
good forming characteristics, optical characteristics and outdoor weathering properties.
(2) Biaxially stretched acrylic material: Stretching acrylic material aligns the polymer chains to
give a laminar structure parallel to the axis of stretch, which enhances resistance to crazing, reduces
crack propagation rates, and improves tensile properties. Stretching acrylic material reduces the
materials formability. In addition, stretched acrylics have less notch sensitivity than unstretched
acrylics.
(3) Properties. Compared with glass, these acrylics are soft and tough. In general, increasing the
temperature causes a decrease in the mechanical properties of the material, increased temperature
does not affect acrylic elongation and impact properties.
(4) Crazing. Both basic forms of acrylics used in aircraft transparencies are affected by crazing.
Crazing is a network of fine cracks that extend over the surface of the plastic sheet (it is not confined to
acrylic materials) and are often difficult to discern. These fine cracks tend to be perpendicular to the
surface, very narrow, and are usually less than 0.025mm (.0010 inches) in depth. Crazing is induced
by prolonged exposure to surface tensile stresses above a critical level or by exposure to organic fluids
and vapours.
(a) Stress crazing may be derived from: residual stresses caused by poor forming practice;
residual surface stresses induced by machining, polishing, or gouging; and prolonged loading inducing
relatively high tensile stresses at a surface.
(b) Stress crazing has a severe effect on the mechanical properties of acrylics; however, the
effects are reduced in stretched materials.
(c) Stress crazing affects the transparency of acrylics. Generally, stretched acrylic panels will
be replaced due to loss of transparency from stress crazing before significant structural degradation
occurs.
(5) Chemical resistance of acrylic materials. Typically, acrylic materials are resistant to inorganic
chemicals and to some organic compounds, such as aliphatic (paraffin) hydrocarbons, hydrogenated
aromatic compounds, fats, and oils.
(a) Acrylic materials are attacked and weakened by some organic compounds such as
aromatic hydrocarbons (benzene), esters (generally in the form of solvents, and some de-icing fluids),
ketones (acetone), and chlorinated hydrocarbons. Some hydraulic fluids are very detrimental to acrylic
materials.
(b) Some detrimental compounds can induce crazing; others may dissolve the acrylic or be
absorbed in the material. Crazing induced by solvent and other organic compounds has more severe
effects on the mechanical properties than stress crazing. Dissolution of the acrylic and chemical
absorption into the acrylic degrades the mechanical properties.
2-D-35
CS–25 BOOK 2
(1) Polycarbonate exhibits very high deflections under impact conditions, which can result in
higher loading into the aircraft structure, compared to glass or acrylic windshield and window panels.
(3) Polycarbonate and stretched acrylic fatigue properties are similar to metals when working
(design) stresses are used for operating pressure loading design.
d. Interlayer Materials. Interlayer materials are transparent adhesive materials used to laminate glass
and plastic structural plies for aircraft applications. Current choices are limited to plasticised polyvinyl
butyral (incompatible with polycarbonate), polyurethane, and silicone. The most commonly used are
true thermoplastics, but some polyurethanes and all silicones contain some cross-linking.
(1) Interlayer materials are considered to be non-structural because they do not directly support
aircraft loads. However, glass windshields are often attached to the airframe structure through metal
inserts bonded to the interlayer. For such designs the residual strength of the windshield in a condition
where all glass plies have failed may be dependent upon the strength of the interlayer. In addition, the
shear coupling effectiveness of the interlayer has a great influence on the stiffness of the laminate.
(2) Most interlayer materials are susceptible to moisture ingress into the laminate and are
protected by compatible sealants in aircraft service.
(3) Interlayer materials, like structural plies, have a useful service life that is controlled by the
surface degradation and removal of the transparency for optical reasons.
5. INTRODUCTION. The recommended methods for showing compliance with CS 25.775(d) for
typical designs of windshields and windows are given in paragraph 7, Test and Analysis. Typical
designs of windshields and cockpit side windows are laminated multi-plied constructions, consisting of
at least two structural plies, facing plies, adhesive interlayers, protective coatings, embedded electro-
conductive heater films or wires, and mounting structure. Typically the structural plies are made from
thermally or chemically toughened glass, or transparent polymeric materials such as polymethyl-
methacrylate (acrylic) and polycarbonate. These plies may be protected from abrasion, mechanical,
and environmental damage by use of facing plies and/or protective coatings. The facing and structural
plies are laminated together with adhesive interlayer material of poly-vinyl butyral (PVB), polyurethane,
or silicone. Cabin window designs are typically multi-paned construction consisting of two structural
panes (a main load bearing pane and a fail-safe pane), inner facing panes, protective coatings, and
mounting structure. Generally, the two structural panes are made from polymethyl-methacrylate and
separated by an air gap. However, there are some cabin window designs that have laminated
structural panes. The designs with the structural panes separated by an air gap usually are such that
the fail-safe pane is not loaded unless the main pane has failed.
a. Items to be considered in designing the mounting for suitability over the ranges of loading and
climatic conditions include but are not limited to:
(3) Differential contraction and expansion between the panes and the mounting,
2-D-36
BOOK 2 CS–25
(4) Deflection of the panel resulting from temperature gradient across the thickness of the panel,
and
b. Fatigue and stress crazing should be evaluated for assemblies using polymeric structural plies. One
way to reduce the occurrence of fatigue and stress crazing is by limiting the maximum working stress
level over the complete panel assembly, making due allowance for expected in service deterioration
resulting from weathering, minor damage, environmental attack, and the use of chemicals/cleaning
fluids. This analysis should be based on:
(1) The appropriate strength of the polymer as declared by the material manufacturer under
sustained loading,
(2) The panel assembly maintained at its normal working temperature as given by the
windshield/window heating system, if installed, and
(3) The ambient temperature on the outside and the cabin temperature on the inside. The most
adverse likely ambient temperature should be covered.
7. TESTS AND ANALYSIS. The windshield and window panels must be capable of withstanding the
maximum cabin pressure differential loads combined with critical aerodynamic pressure and
temperature effects for intact and single failure conditions in the installation of associated systems.
When substantiation is shown by test evidence, the test apparatus should closely simulate the
structural behaviour (e.g., deformation under pressure loads) of the aircraft mounting structure up to
the ultimate load conditions. Analysis may be used if previous testing can validate it. The effects of the
following material characteristics should be evaluated and accounted for in the design and test results:
notch sensitivity, fatigue, crazing, aging effects, corrosion (degradation by fluids), temperature, UV
degradation, material stability, creep, and the function and working life of the interlayer. An acceptable
route for the strength substantiation of a windshield or window panel is set out below.
(1) Conduct a detailed structural analysis using an appropriate structural analysis method to
identify the highest stressed areas of the windshield or window panel. Subsequently confirm the
structural analysis by subjecting a representatively mounted and instrumented windshield or window
panel to ultimate load conditions. The panel should be subjected to the most adverse combinations of
pressure loading, including the maximum internal pressure, external aerodynamic pressure,
temperature effects, and where appropriate, flight loads.
(2) Establish allowable strength values including allowance for material production variability,
material characteristics, long term degradation, and environmental effects for each structural ply from
relevant coupon or sub-component test evidence. Check the critical design case to ensure that the
allowables are not exceeded by the design ultimate stresses.
(3) In lieu of 7.a.(2) above, perform a test above ultimate pressure load to account for material
production variability, material characteristics, long term degradation, and environmental effects. In lieu
of a rational analysis substantiating the degree of increased loading above ultimate, a factor of 2.0 may
be used (ultimate is defined as 1.5 times the pressure load defined in CS 25.365(d)). A separate test
fixture may be needed to preclude loading the airframe above ultimate capability.
b. Fatigue. Conventional windshield and window panel materials exhibit good intrinsic fatigue
resistance properties, but the variability in fatigue life is greater than that in aircraft quality metals. Thus
a conventional cyclic fatigue test, but of extended duration, may be used to cover this variability.
Testing at an elevated stress level for one aircraft lifetime could also give the necessary assurance of
reliability. These approaches require consideration of the endurance of the metal parts of the mounting
structure. Another approach that may be used in lieu of testing is to maintain the maximum working
stresses in the windshield and window panel below values at which fatigue will occur. The maximum
2-D-37
CS–25 BOOK 2
working stress level over the complete panel assembly should be shown by supporting evidence not to
exceed values consistent with the avoidance of fatigue and stress crazing, considering deterioration
resulting from weathering, minor damage and scratching in service, and use of cleaner fluids, etc.
Fatigue resistance of the mounting structure should be covered separately as part of the fuselage
fatigue substantiation.
c. Fail-Safe. Fail-safe strength capability of the windshield and window panels should be
demonstrated after any single failure in the installation or associated systems. The demonstration
should account for material characteristics and variability in service material degradation, critical
temperature effects, maximum cabin differential pressure, and critical external aerodynamic pressure.
The requirements of CS 25.571 for the windshield or window panels may be met by showing
compliance with the fail-safe criteria in this AMC. Other single failures (besides the windshield and
window panels) in the installation or associated systems should also be considered. An acceptable
approach for demonstrating compliance is defined by the following method:
(1) Conduct an analysis to establish the critical main pressure bearing ply.
(2) To account for the dynamic effects of a ply failure, test the representatively mounted
windshield and window panel by suddenly failing the critical ply under the maximum cabin differential
pressure (maximum relief valve setting) combined with the critical external aerodynamic pressure with
critical temperature effects included.
(a) For windshield and window panel failures obvious to the flightcrew, the test pressure may
be reduced after initial critical pane failure to account for crew action defined in the flight manual
procedures. The failed windshield or window panel should withstand this reduced pressure for the
period of time that would be required to complete the flight.
(b) For windshield and window panel failures, which would not be obvious to a flightcrew, the
test pressure should be held for a time sufficient to account for the remaining period of flight. During
the period of time when the test pressure is held, the effects of creep (if creep could occur) should be
considered.
(3) Check the fail-safe stresses in all intact structural plies determined in 7c(2) to ensure that
they do not exceed the material allowables developed to account for material production variability,
material characteristics, long term degradation, and environmental effects.
(4) In lieu of 7c(3) above, to account for material production variability, material characteristics,
long term degradation, and environmental effects, additional fail-safe testing of the windshield and
window panel to loads above the fail-safe loads following the procedures defined in 7c(2) above should
be conducted. In lieu of a rational analysis substantiating the degree of increased loading, a factor may
be used, as shown in the table below. The factored loads should be applied after the failure of the
critical ply. A separate test fixture may be needed to preclude loading the airframe above ultimate
capability. The panel tested in 7c(2) may be used for this test.
(5) Load Factors (applied after the failure of the critical ply):
Material Factor
Glass 2.0
Stretched Acrylic 2.0
Cast Acrylic 4.0
Polycarbonate 4.0
(6) Other single failures in the installation or the associated systems as they affect the
transparency should also be addressed. Such failures include broken fasteners, cracked mounting
components, and malfunctions in windshield heat systems.
2-D-38
BOOK 2 CS–25
AMC 25.785(c)
Seats and Safety Belts
1 Sharp edges or excrescences on the seats or parts of the passenger accommodation which
might prove a source of danger not only to the occupants of the seats but particularly to the occupant
seated to the rear should be avoided. All surfaces of passenger accommodation and those areas of
the seat back lying within the arc of travel of the head of an occupant seated to the rear and restrained
by a safety belt should be smooth and of large radius.
2 The radius of the arc of travel, representing the extremity of the occupant’s head, should be
taken as 71 cm (28 in). This allows for tall occupants and stretch in the safety belt. The centre of the
radius of the arc of travel should be taken as 46 cm (18 in) forward and upward of the junction of the
seat back and bottom at 35° to the latter (see Figure 1).
FIGURE 1
3 If the top of the seat back occurs within the arc of travel of the head, it should be padded to at
least 25 mm (1 in) radius with at least 12·5 mm (0·5 in) of firm padding.
4 Any other substantially horizontal members occurring within the areas defined by paragraph 2
should either be padded as recommended in paragraph 3 or should be so arranged that the head will
be deflected past them rather than strike them a direct blow. The tops of vertical members occurring
within these areas should be so protected as to be at least as safe as horizontal members. No
member should occur where it might be struck by the throat.
AMC 25.785(g)
Seats, Berths, Safety Belts and Harnesses
Where there is a risk that a safety belt or harness might, when not in use, foul the controls or impede
the crew, suitable stowage should be provided, unless it can be shown that the risk can be avoided by
the application of suitable crew drills.
2-D-39
CS–25 BOOK 2
AMC 25.787(b)
Stowage Compartments
For stowage compartments in the passenger and crew compartments it must be shown by analysis
and/or tests that under the load conditions as specified in CS 25.561(b)(3), the retention items such as
doors, swivels, latches etc., are still performing their retention function. In the analysis and/or tests the
expected wear and deterioration should be taken into account.
AMC 25.791
Passenger information signs and placards
Relevant part of the FAA Advisory Circular 25-17 Transport Airplane Cabin Interiors Crashworthiness
Handbook, dated 15.7/91, are accepted by the Agency as providing acceptable means of compliance
with CS 25.791.
Note: “relevant parts” means “the part of the AC 25-17 that addresses the applicable FAR/CS-25 paragraph”.
AMC 25.795
Security considerations
Referenced Documentation:
- FAA memorandum, Subject Information: Certification of strengthened Flight Deck Doors
on Transport Category Airplanes, Original release 6 November 2001.
AMC 25.795(a)(1)
Flightdeck intrusion resistance.
Referenced Documentation:
- Federal Aviation Administration Advisory Circular (AC) 25.795-1, Flightdeck Intrusion
Resistance, issue date 10 January 2002
AMC 25.795(a)(2)
Flightdeck penetration resistance
Referenced Documentation:
- Federal Aviation Administration Advisory Circular (AC) 25.795-2, Flightdeck Penetration
Resistance, issue date 10 January 2002
- Level IIIA of the (US) National Institute of Justice, Ballistic Resistance of Personal Body
Armor, NIJ Standard 0101.04, Office of Science and Technology, Washington, D.C.
20531, September 2000.
AMC 25.803
Emergency evacuation
Relevant part of the FAA Advisory Circular 25-17 Transport Airplane Cabin Interiors Crashworthiness
Handbook, dated 15/7/91 and AC 25.803-1 Emergency Evacuation Demonstrations, dated 13/11/89
are accepted by the Agency as providing acceptable means of compliance with CS 25.803.
Note: “relevant parts” means “the part of the AC 25-17 that addresses the applicable FAR/CS-25 paragraph”.
2-D-40
BOOK 2 CS–25
The term ‘unobstructed’ should be interpreted as referring to the space between the adjacent wall(s)
and/or seat(s), the seatback(s) being in the most adverse position, in vertical projection from floor level
to at least the prescribed minimum height of the exit.
AMC 25.807
Emergency lighting
Relevant part of the FAA Advisory Circular 25-17 Transport Airplane Cabin Interiors Crashworthiness
Handbook, dated 15/7/91 and AC 25.812-2 Floor Proximity Emergency Escape Path Marking Systems
Incorporating Photoluminescent Elements, dated 24/7/97 are accepted by the Agency as providing
acceptable means of compliance with CS 25.812.
Note: “relevant parts” means “the part of the AC 25-17 that addresses the applicable FAR/CS-25 paragraph”.
AMC 25.807(d)
Passenger Emergency Exits
The optimum fore and aft location of Types I, II and III exits should be agreed between the applicant
and the Agency bearing in mind the relevant considerations, including –
a. The varying likelihood of damage to different parts of the fuselage in emergency alighting
conditions, and
b. The need to avoid the passengers having to evacuate the aeroplane where dangerous
conditions (spilt fuel, hot engine parts, etc.) may exist.
AMC 25.810(c)(2)
Emergency Evacuation
Acceptable methods of measurement of reflectance are given in AC20-38A and AC20-47, published by
the Federal Aviation Administration.
AMC 25.811(e)(4)
Emergency Exit Marking
The indicating markings for all Type II and larger passenger emergency exit unlocking handle motions
should conform to the general shapes and dimensions indicated by Figures 1 and 2.
NOTE: As far as is practicable the markings should be located to avoid obscuring viewing windows located on or
alongside the exits, or coincidence with any other required marking or safety feature.
2-D-41
CS–25 BOOK 2
Where practical and unambiguous arrow point and base of arrow shaft to be within ±25 mm (1 inch) of
fully unlocked and fully locked positions respectively
DIMENSIONS
A = 19 mm (0·75") minimum
B = 2xA
C = B (recommended)
FIGURE 1
DIMENSIONS
A = 19 mm (0·75") minimum
B = 2xA
C = B (recommended)
FIGURE 2
2-D-42
BOOK 2 CS–25
AMC 25.812
Emergency lighting
Relevant parts of FAA Advisory Circular 25-17 Transport Airplane Cabin Interiors Crashworthiness
Handbook, dated 15/7/91 and AC 25.812-2 Floor Proximity Emergency Escape Path Marking Systems
Incorporating Photoluminescent Elements, dated 24/7/97 are accepted by the Agency as providing
acceptable means of compliance with CS 25.812.
Note: "relevant parts" means " the part of the AC 25-17 that addresses the applicable FAR/CS-25 paragraph".
AMC 25.815
Width of aisle
Relevant part of the FAA Advisory Circular 25-17 Transport Airplane Cabin Interiors Crashworthiness
Handbook, dated 15/7/91, are accepted by the Agency as providing acceptable means of compliance
with CS 25.815.
Note: “relevant parts” means “the part of the AC 25-17 that addresses the applicable FAR/CS-25 paragraph”.
AMC 25.831(a)
Ventilation
The supply of fresh air in the event of the loss of one source, should not be less than 0.18 kg/min (0·4
lb/min) per person for any period exceeding five minutes. However, reductions below this flow rate
may be accepted provided that the compartment environment can be maintained at a level which is not
hazardous to the occupant.
AMC 25.831(c)
Ventilation
1 To avoid contamination the fresh air supply should be suitably ducted where it passes through
any compartment inaccessible in flight.
2 Where the air supply is supplemented by a recirculating system, it should be possible to stop
the recirculating system and –
b. Still achieve 1.
AMC 25.851(a)
Fire Extinguishers
1 Each extinguisher should be readily accessible and mounted so as to facilitate quick removal
from its mounting bracket.
2 Unless an extinguisher is clearly visible, its location should be indicated by a placard or sign
having letters of at least 9.5 mm (0·375) inches in height on a contrasting background. Appropriate
symbols may be used to supplement such a placard or sign.
2-D-43
CS–25 BOOK 2
AMC 25.851(a)(1)
Fire Extinguishers
1 The number and location of hand fire extinguishers should be such as to provide adequate
availability for use, account being taken of the number and size of the passenger compartments and
the location of toilets, galleys, etc. These considerations may result in the number being greater than
the minimum prescribed.
2 Where only one hand extinguisher is required it should be located at the cabin crew member
station, where provided, otherwise near the main entrance door.
3 Where two or more hand extinguishers are required and their location is not otherwise dictated
by consideration of paragraph 1 above, an extinguisher should be located at each end of the cabin and
the remainder distributed throughout the cabin as evenly as is practicable.
AMC 25.851(a)(2)
Fire Extinguishers
There should be at least one fire extinguisher suitable for both flammable fluid and electrical equipment
fires installed in each pilot’s compartment. Additional extinguishers may be required for the protection
of other compartments accessible to the crew in flight (e.g. electrical equipment bays) or from
consideration of CS 25.851(a)(2).
NOTE: Dry chemical fire extinguishers should not be used in pilot compartments because of the adverse effects on
vision during discharge and, if non-conductive, interference with electrical contacts by the chemical residues.
AMC 25.853
Compartment interiors
Relevant part of the FAA Advisory Circular 25-17 Transport Airplane Cabin Interiors Crashworthiness
Handbook, dated 15/7/91, AC 25.853-1 dated 17/9/86 and AC 25-18 dated 6/1/94 are accepted by the
Agency as providing acceptable means of compliance with CS 25.853.
Note: “relevant parts” means “the part of the AC 25-17 that addresses the applicable FAR/CS-25 paragraph”.
AMC 25.857
Cargo Compartment Classification
Relevant part of the FAA Advisory Circular 25-17 Transport Airplane Cabin Interiors Crashworthiness
Handbook, dated 15/7/91, AC 25-9A Smoke Detection, Penetration, and Evacuation Tests and Related
Flight Manual Emergency Procedures, dated 6/1/94, and AC 25-18 Transport Category Airplanes
Modified for Cargo Service, dated 6/1/94 are accepted by the Agency as providing acceptable means
of compliance with CS 25.857.
Note: “relevant parts” means “the part of the AC 25-17 that addresses the applicable FAR/CS-25 paragraph”.
2-D-44
BOOK 2 CS–25
AMC 25.863(a)
Flammable fluid fire protection
The cooling air supply for any electrical or electronic equipment should be conveyed and discharged so
as not to create a hazard following failure of the equipment.
Zones with surfaces which may be exposed to flammable fluids or vapours should be ventilated if the
temperature of the surfaces may exceed (under normal or failure conditions) a dangerous value with
regard to these fluids or vapours. Unless a higher value can be substantiated, a temperature
exceeding 200°C is considered dangerous.
AMC 25.869(a)(1)
Electrical System Fire and Smoke Protection
These requirements, and those of CS 25.863 applicable to electrical equipment, may be satisfied by
the following:
1 Electrical components in regions immediately behind firewalls and in engine pod attachment
structures should be of such materials and at such a distance from the firewall that they will not suffer
damage that could hazard the aeroplane if the surface of the firewall adjacent to the fire is heated to
1100°C for 15 minutes.
2 Electrical equipment should be so constructed and/or installed that in the event of failure, no
hazardous quantities of toxic or noxious (e.g. smoke) products will be distributed in the crew or
passenger compartments.
3 Electrical equipment, which may come into contact with flammable vapours should be so
designed and installed as to minimise the risk of the vapours exploding under both normal and fault
conditions. This can be satisfied by meeting the Explosion Proofness Standards of RTCA DO-
160/EUROCAE ED-14.
AMC 25.869(c)
Fire Protection for Oxygen Equipment
1 High-pressure shut-off valves should be designed to provide effective slow opening and
closing, so as to avoid the possible risk of fire or explosion.
2 Re-charging systems, if installed, should be provided with means to prevent excessive rates of
charging which could result in dangerously high temperatures within the system. The charging system
should also provide protection from contamination.
3 The compartments in which high-pressure system components, including source(s) are located
should have adequate ventilation to ensure the rapid dilution of leaked oxygen. Such compartments
should also provide adequate protection against contamination by liquids and other products which
could result in the risk of fire.
4 Where in-situ charging facilities are provided, the compartments in which they are located
should be accessible from outside the aircraft and as remote as possible from other service points and
equipment. Placards should be provided, located adjacent to the servicing point, with adequate
instructions covering the precautions to be observed when the system is being charged.
2-D-45
CS–25 BOOK 2
5 The installation of the system should be such that components and pipe lines –
d. Are protected against grease or other lubricants, and are protected against the effects of
vibration.
In addition, joints should where possible, be assembled dry, but where compounds are used for sealing
they should be approved for that purpose.
6 Where the oxygen is supplied from chemical generators, the effects of heat emission, during
both normal and inadvertent operation, on both the installation and other adjacent equipment, should
be taken into account.
AMC 25.899
Electrical Bonding and Protection Against Static Electricity
Refer to EUROCAE document ED-84 (including Amendment N°1 dated 06/09/99) titled : Aircraft
Lightning Environment and Related Test Waveforms; or equivalent SAE ARP5412 document.
3.1 General. All items, which by the accumulation and discharge of static charges may cause a
danger of electrical shock, ignition of flammable vapours or interference with essential equipment (e.g.
radio communications and navigational aids) should be adequately bonded to the main earth systems.
3.2 Intermittent Contact. The design should be such as to ensure that no fortuitous intermittent
contact can occur between metallic and/or metallized parts.
3.3 High Pressure Refuelling and Fuel Transfer. Where provision is made for high pressure
refuelling and/or for high rates of fuel transfer it should be established, by test, or by consultation with
the appropriate fuel manufacturers, that dangerously high voltages will not be induced within the fuel
system. If compliance with this requirement involves any restriction on the types of fuel to be used or
on the use of additives, this should be established.
3.3.1 With standard refuelling equipment and standard aircraft turbine fuels, voltages high enough to
cause sparking may be induced between the surface of the fuel and the metal parts of the tank at
refuelling flow velocities above approximately 7 meters/second (23 feet/second). These induced
voltages may be increased by the presence of additives and contaminants (e.g. anti-corrosion
inhibitors, lubricating oil, free water), and by splashing or spraying of the fuel in the tank.
a. By means taken in the refuelling equipment such as increasing the diameter of refuelling lines
and designing filters to give the minimum of electrostatic charging, or
2-D-46
BOOK 2 CS–25
b. By changing the electrical properties of the fuel by the use of anti-static additives and thus
reducing the accumulation of static charge in the tank to negligible amount.
3.3.3 The critical refuelling rates are related to the aeroplane refuelling installations, and the
designer should seek the advice of fuel suppliers on this problem.
4.1 Primary bonding paths are those paths which are required to carry lightning discharge
currents. These paths should be of as low an electrical impedance as is practicable. Secondary
bonding paths are those paths provided for other forms of bonding.
4.2 Where additional conductors are required to provide or supplement the inherent primary
bonding paths provided by the structure or equipment, then the cross-sectional area of such primary
conductors made from copper should be not less than 3 mm2 except that, where a single conductor is
likely to carry the whole discharge from an isolated section, the cross-sectional area would be not less
than 6 mm2. Aluminium primary conductors should have a cross-sectional area giving an equivalent
surge carrying capacity.
a. Connecting together the main earths of separable major components which may carry lightning
discharges,
c. Connecting to the main earth all metal parts presenting a surface on or outside of the external
surface of the aeroplane, and
4.4 Where additional conductors are required to provide or supplement the inherent secondary
bonding paths provided by the structure or equipment then the cross-sectional area of such secondary
conductors made from copper should be not less than 1 mm2. Where a single wire is used its size
should be not less than 1·2 mm diameter.
5.1.1 The extremities of the fixed portions of the aeroplane and such fixed external panels and
components where the method of construction and/or assembly leads to doubt as to the repeatability of
the bond, e.g. removable panels.
5.1.3 External movable metal surfaces or components and the main aeroplane earth.
5.1.4 The bonding conductors of external non-metallic parts and the main aeroplane earth.
5.1.5 Internal components for which a primary bond is specified and the main aeroplane earth.
5.2.1 Metallic parts, normally in contact with flammable fluids, and the main aeroplane earth.
2-D-47
CS–25 BOOK 2
5.2.2 Isolated conducting parts subject to appreciable electrostatic charging and the main aeroplane
earth.
5.2.3 Electrical panels and other equipment accessible to the occupants of the aeroplane and the
main aeroplane earth.
5.2.4 Earth connections, which normally carry the main electrical supply and the main aeroplane
earth. The test on these connections should be such as to ensure that the connections can carry,
without risk of fire or damage to the bond, or excessive volt drop, such continuous normal currents and
intermittent fault currents as are applicable.
5.2.5 Electrical and electronic equipment and the aeroplane main earth, where applicable, and as
specified by the aeroplane constructor.
6.1 In the case of lightning protection, for the partial conductors the method of surface protection
will vary with the criticality of the structure in question. Deterioration of the means of protection or
possible hidden damage to the material which may affect its structural integrity, need to be considered.
While such materials provide a measure of electro-magnetic screening, the need for additional
measures will be a function of the location of the material in relation to critical equipment and wiring in
the aircraft. Particular attention will also have to be given to the protection required near fuel systems
– e.g. fuel tanks.
For non-conducting materials which have no intrinsic lightning protection or screening properties, the
measures taken will again depend on the relative locations of the material and critical systems or fuel
and the possible loss of the components due to internal air pressures in the event of a strike.
6.2 The partial conducting materials should present no problem in dissipating P-static but
problems can arise with the non-conductors. Depending upon the location of the material, protection
may be required.
6.3 Electrical currents, other than lightning, can flow in some partial conducting materials and
means may be required to limit this by provision of alternative current paths if the effect of large
voltage drop is important or if such currents can damage the material.
6.4 Particular care has to be taken that all joints, permanent and temporary, are capable of
carrying any currents which may flow particularly those resulting from lightning strikes. Structural
damage and loss of screening capabilities may occur if these are not adequately controlled.
6.5 The adequacy of the material in supplying a ground plane for antenna may have to be
considered. Again it will vary with the material and the radio frequency of the system.
2-D-48
BOOK 2 CS–25
AMC – SUBPART E
AMC 25.901(b)(2)
Assembly of Components
The objectives of CS 25.671(b) should be satisfied with respect to powerplant systems, where the safety of
the aeroplane could otherwise be jeopardised.
AMC 25.901(b)(4)
Electrical Bonding
Where the engine is not in direct electrical contact with its mounting, the engine should be electrically
connected to the main earth system by at least two removable primary conductors, one on each side of the
engine.
AMC 25.903(e)(2)
Engines
1 General
1.1 In general the relight envelope required in CS 25.903(e)(2) may consist of two zones –
a. One zone where the engine is rotated by windmilling at or beyond the minimum rpm to effect a
satisfactory relight, and
b. Another zone where the engine is rotated with assistance of the starter at or beyond the minimum
rpm to effect a satisfactory relight.
1.2 The minimum acceptable relight envelope is defined in paragraph 2.
b. At least fifteen minutes or until the engine oil temperatures are stabilised at their cold soak value.
2-E-1
CS–25 BOOK 2
AMC 25.905(d)
Release of Propeller Debris
1 Propeller Installation. Design features of the propeller installation, including its control system,
which are considered to influence the occurrence of propeller debris release and/or mode of such a failure
should be taken into account when assessing the aeroplane against CS 25.905(d).
2 Aeroplane Design Conditions
2.1 Impact Damage Zone. All practical precautions should be taken in the aeroplane design to
minimise, on the basis of good engineering judgement, the risk of Catastrophic Effects due to the release of
part of, or a complete propeller blade. These precautions should be taken within an impact zone defined by
the region between the surfaces generated by lines passing through the centre of the propeller hub making
angles of at least five degrees forward and aft of the plane of rotation of each propeller. Within this zone at
least the following should be considered.
a. The vulnerability of critical components and systems (e.g. location, duplication, separation,
protection); and
b. The fire risk in the event of flammable fluid release in association with potential ignition sources
(e.g. location, protection, shut-off means).
2.2 Other Considerations. Consideration should be given to the effects on the aeroplane resulting from
–
a. The likely out of balance forces due to the release of part of, or a complete propeller blade; and
AMC 25.929(a)
Propeller De-icing
Where the propeller has been fitted to the engine in complying with the tests of AMC E 780, compliance with
CS 25.929(a) will be assured.
AMC 25.939(a)
Turbine Engine Operating Characteristics
The wording ‘in flight’ should be interpreted to cover all operating conditions from engine start until shut-
down.
AMC 25.939(c)
Turbine Engine Operating Characteristics
1 The investigation should cover the complete range, for which certification is required, of aeroplane
speeds, attitudes, altitudes and engine operating conditions including reverse thrust, and of steady and
transient conditions on the ground and in flight, including crosswinds, rotation, yaw and stall. Non-critical
conditions of operation which need not be considered should be agreed with the Agency.
2 If the airflow conditions at the engine air intake can be affected by the operating conditions of an
adjacent engine, the investigation should include an exploration of the effects of running the adjacent engine
at the same and at different conditions over the whole range of engine operating conditions, including
reverse thrust. An investigation of the effect of malfunctioning of an adjacent engine should also be
included.
3 Compliance with the requirement may include any suitable one or combination of the following
methods; as agreed with the Agency.
2-E-2
BOOK 2 CS–25
a. Demonstration that the variations in engine inlet airflow distortion over the range defined in 1 are
within the limits established for the particular engine type.
b. An investigation of blade vibration characteristics by the method and of the scope indicated in CS–E
650 and AMC E 650 (except that Maximum Take-off rpm need not be exceeded) carried out on –
i A representative installation on the ground using test equipment where the actual conditions of
operation in the aeroplane are reproduced, or
ii A representative aeroplane on the ground and in flight as appropriate to the conditions being
investigated.
c. The completion of sufficient flying with representative installations prior to certification such as to
demonstrate that the vibration levels are satisfactory.
AMC 25.939
Turbine Engine Operating Characteristics
FAA Advisory Circular 25.939-1 Evaluating Turbine Engine Operating Characteristics, date 19/03/86, is
accepted by the Agency as providing acceptable means of compliance with CS 25.939.
AMC 25.951(d)
Fuel System – General
Acceptable means of compliance with CS 25.951(d) include one of the following:
(1) Incorporation of a Agency-approved system that re-circulates the fuel back into the fuel system.
(2) Capping or securing the pressurisation and drain valve.
(3) Manually draining the fuel from a holding tank into a container.
AMC 25.954
Fuel System Lightning Protection
1 The fuel storage system and the outlets of the venting and jettisoning systems of the aeroplane,
should be so situated and/or protected, that the probability of a catastrophe being caused by them being
struck by lightning is extremely improbable.
NOTE: The location of the fuel tanks and vents within the airframe may be such as to satisfy this.
2 In addition, the outlets of venting and jettisoning systems should be so located and designed that –
a. They will not, under any atmospheric conditions which the aeroplane may encounter, experience
electrical discharges of such magnitudes as will ignite any fuel/air mixture of the ratios likely to be present,
and
b. The fuel and its vapours in flammable concentrations will not pass close to parts of the aeroplane
which will produce electrical discharges capable of igniting fuel/air mixtures.
NOTE: Electrical discharges may, in addition to direct lightning strikes, be caused by corona and streamer formation in
the vicinity of thunderstorms.
3 The fuel system of the aeroplane should be so designed that the passage of lightning discharges
through the main aeroplane structure will not produce, by the process of conduction or induction, such
potential differences as will cause electrical sparking through areas where there may be flammable vapours.
NOTE: For aeroplanes of conventional shape, an acceptable method of complying with CS 25.954 is given in FAA
Advisory Circular AC20-53A – ‘Protection of Aircraft Fuel Systems against Fuel Vapour Ignition due to Lightning’. For
aeroplanes of non-conventional shape, re-definition of the zones may be necessary.
2-E-3
CS–25 BOOK 2
AMC 25.955(a)(4)
Fuel Flow
The word ‘blocked’ should be interpreted to mean ‘with the moving parts fixed in the position for maximum
pressure drop’.
AMC 25.963(a)
Fuel Tanks: General
Precautions should be taken against the possibility of corrosion resulting from microbiological contamination
of fuel.
AMC 25.963(d)
Fuel Tanks: General
Fuel tank installations should be such that the tanks will not be ruptured by the aeroplane sliding with its
landing gear retracted, nor by a landing gear, nor an engine mounting tearing away.
Fuel tanks inboard of the landing gear or inboard of or adjacent to the most outboard engine, should have
the strength to withstand fuel inertia loads appropriate to the accelerations specified in CS 25.561(b)(3)
considering the maximum likely volume of fuel in the tank(s). For the purposes of this substantiation it will
not be necessary to consider a fuel volume beyond 85% of the maximum permissible volume in each tank.
For calculation of inertia pressures a typical density of the appropriate fuel may be used.
AMC 25.963(g)
Fuel Tanks: General
1 Purpose. This AMC sets forth an acceptable means of showing compliance with the provisions of
CS–25 dealing with the certification requirements for fuel tank access covers. Guidance information is
provided for showing compliance with the impact resistance requirements of 25.963(g).
2 Background. Fuel tank access covers have failed in service due to impact with high speed objects
such as failed tyre tread material and engine debris following engine failures. Failure of an access cover on
a wing fuel tank may result in the loss of hazardous quantities of fuel which could subsequently ignite.
3 Impact Resistance
a. All fuel tank access covers must be designed to minimise penetration and deformation by tyre
fragments, low energy engine debris, or other likely debris, unless the covers are located in an area where
service experience or analysis indicates a strike is not likely. The rule does not specify rigid standards for
impact resistance because of the wide range of likely debris which could impact the covers. However,
‘minimise penetration and deformation’ should be achieved by testing covers using debris of a type, size,
trajectory, and velocity that represents conditions anticipated in actual service for the aeroplane model
involved. There should be no hazardous quantity of fuel leakage after impact. The access covers, however,
need not be more impact resistant than the contiguous tank structure.
b. In the absence of a more rational method, the following criteria should be used for evaluating
access covers for impact resistance.
i. Covers located within 15° inboard and outboard of the tyre plane of rotation, measured from the
centre plane of tyre rotation with olco strut in the nominal position, should be evaluated. The evaluation
should be based on the results of impact tests using tyre tread segments having width and length equal to
the full width of the tread, with thickness of the full tread plus casing. The velocities used in the assessment
should be based on the highest speed that the aircraft is likely to use on the ground. Generally, this will be
the higher of the aircraft rotation speed (VR) and the flapless landing speed.
ii. Covers located within 15° forward of the front compressor or fan plane measured from the centre of
rotation to 15° aft of the rearmost turbine plane measured from the centre of rotation, should be evaluated
2-E-4
BOOK 2 CS–25
for impact from small fragments (shrapnel). The covers need not be designed to withstand impact from high
energy engine fragments such as rotor segments.
AMC 25.965(a)
Fuel Tank Tests
The analysis or tests should be performed on each complete tank in the configuration ready and capable of
flight. Each complete tank means any tank fully equipped which is isolated from other tanks by tank walls or
which may be isolated by valves under some flight configurations.
AMC 25.967(a)(3)
Fuel Tank Installation
The installation of a flexible tank and its venting, according to CS 25.975(a)(3) should be such that the tank
liner will not be deformed in such a way as to significantly affect the fuel quantity indication.
AMC 25.979(d)
Pressure Fuelling Systems
1 Pressure fuelling systems, fuel tanks and the means preventing excessive fuel pressures, should be
designed to withstand normal maximum fuelling pressure of not less than 345 kN/m2 (50 psi) at the coupling
to the aeroplane.
2 Pressure fuelling systems should be so arranged that the fuel entry point is at or near the bottom of
the tank so as to reduce the level of electrostatic charge in the tank during fuelling.
AMC 25.981
Fuel Tank Temperature
FAA Advisory Circular 25.981-1A, Guidelines For Substantiating Compliance With The Fuel Tank
Temperature Requirements, dated 20/01/71, is accepted by the Agency as providing acceptable means of
compliance with CS 25.981.
AMC 25.994
Fuel System Components
FAA Advisory Circular 25.994-1 Design Considerations To Protect Fuel Systems During A Wheels-Up
Landing, dated 24/07/86, is accepted by the Agency as providing acceptable means of compliance with CS
25.994.
AMC 25.1027
Inadvertent Propeller Feathering
The design of the propeller feathering system should be such that it is possible to complete the feathering
and the unfeathering operation under all normal operating conditions.
AMC 25.1027(b)
Propeller Feathering
The amount of trapped oil should be sufficient to cover one feathering operation; taking into account the
maximum oil leakage in the feathering system due to wear and deterioration in service.
2-E-5
CS–25 BOOK 2
AMC 25.1041
Tests in hot climatic conditions
The need for additional tests, if any, in hot climatic conditions should take account of any tests made by the
engine constructor to establish engine performance and functioning characteristics and of satisfactory
operating experience of similar power units installed in other types of aeroplane.
The maximum climatic conditions for which compliance will be established should be declared and this
should not be less severe than the ICAO Intercontinental Maximum Standard Climate (37⋅8°C (100°F) at sea
level). If the tests are conducted under conditions which deviate from the maximum declared ambient
temperature, the maximum temperature deviation should not normally exceed 13⋅9°C (25°F).
AMC 25.1091(d)(2)
Precipitation Covered Runways
1 Except where it is obvious by inspection or other means, that precipitation on the runway would not
enter the engine air intake under the declared operating conditions, including the use of the thrust reverser,
compliance with the requirements should be demonstrated by tests using tyres representative of those to be
approved for operational use. These tests should clear the aeroplane for operation from runways which are
normally clear and also for operation in precipitation up to 13 mm (0·5 in) depth of water or dense slush.
The tests should be conducted with the minimum depth of 13 mm (0·5 in) and an average depth of 19 mm
(0·75 in), or if approval is sought for a greater depth than 13 mm (0·5 in), the average depth should be 1·5
times the depth for which the take-offs are to be permitted, and the minimum depth should be not less than
the depth for which take-offs are to be permitted.
2 It should be shown that the engines operate satisfactorily without unacceptable loss of power at all
speeds from zero up to lift-off speed and in the attitudes likely to be used. Any special aeroplane handling
techniques necessary to ensure compliance with the requirement should comply with the handling
techniques assumed in establishing the scheduled performance of the aircraft.
3 The tests may be made in water or slush either by complete take-offs and landings as necessary in
the specified precipitation conditions, or by a series of demonstrations in areas of precipitation sufficiently
large to permit the spray pattern to become stabilised and to determine engine behaviour and response.
Experience has shown that where a trough is used, a length of 70 to 90 m (230 to 295 ft) is usually
satisfactory. If marginal results are obtained the effect of the difference between water and slush should be
examined.
4 The effects of cross-winds should be examined and where necessary a cross-wind limitation
established for inclusion in the Flight Manual for operation from precipitation covered runways.
5 It may be difficult to deduce the effect of low density precipitation (dry snow) from high density
testing, but nevertheless clearance of the aeroplane for operation in dense precipitation up to 13 mm (0·5 in)
will usually clear the aeroplane for operation in low density precipitation of depths greater than 10 cm (4 in)
depth. If clearance is requested for operation in low density precipitation of depths greater than 10 cm (4 in)
additional tests (in low density precipitation having a depth close to that for which approval is sought) will be
necessary.
6 When auxiliary devices are fitted to prevent spray from being ingested by the engines it will be
necessary to do additional tests in low density precipitation to permit operations in depths greater than 25
mm (1 in).
AMC 25.1091(e)
Air Intake System
The parts or components to be considered are, for example, intake splitters, acoustic lining if in a vulnerable
location and inlet duct-mounted instrumentation.
2-E-6
BOOK 2 CS–25
AMC 25.1093(b)
Propulsion Engine Air Intakes
1 General. Two ways of showing compliance with CS 25.1093(b) are given.
1.1 Method 1. Method 1 is an arbitrary empirical method based on United Kingdom and French
practice. This method is acceptable to all participating countries.
1.2 Method 2. Method 2 is a general approach based on US practice in applying FAR Part 25,
Appendix C. If this method is used, each application will have to be evaluated on its merits.
2 Method 1 (Acceptable Means of Compliance)
2.1 In establishing compliance with the requirements of CS 25.1093(b), reference should be made to
AMC 25.1419, paragraph 1.
2.2 The intake may be tested with the engine and propeller where appropriate in accordance with the
requirements of CS–E 780 and AMC E 780.
2.3 When the intake is assessed separately (e.g. lack of suitable test facilities, change in the design of
the intake, intake different from one tested with the engine) it should be shown that the effects of intake icing
would not invalidate the engine tests of CS–E. Factors to be considered in such evaluation are:
a. Distortion of the airflow and partial blockage of the intake.
b. The shedding into the engine of intake ice of a size greater than the engine is known to be able to
ingest.
c. The icing of any engine sensing devices, other subsidiary intakes or equipment contained within the
intake.
d. The time required to bring the protective system into full operation.
2.4 Tests in Ice-forming Conditions. An acceptable method of showing compliance with the
requirements of CS 25.1093(b), including Appendix C, is given in this paragraph.
2.4.1 When the tests are conducted in non-altitude conditions, the system power supply and the external
aerodynamic and atmospheric conditions should be so modified as to represent the required altitude
condition as closely as possible. The altitudes to be represented should be as indicated in Table 1 for
simulated tests, or that appropriate to the desired temperature in flight tests, except that the test altitude
need not exceed any limitations proposed for approval. The appropriate intake incidences or the most
critical incidence, should be simulated.
2.4.2 A separate test should be conducted at each temperature condition of Table 1, the test being made
up of repetitions of either the cycle –
a. 28 km in the conditions of Table 1 column (a) appropriate to the temperature, followed by 5 km in
the conditions of Table 1 column (b) appropriate to the temperature, for a duration of 30 minutes, or
b. 6 km in the conditions of Table 1 column (a) appropriate to the temperature, followed by 5 km in the
conditions of Table 1 column (b) appropriate to the temperature, for a duration of 10 minutes.
TABLE 1
Mean effective
Ambient air Altitude Liquid water content (g/m3) droplet
temperature diameter
2-E-7
CS–25 BOOK 2
2.4.3 Either by separate tests, or in combination with those of 2.4.2 it should be demonstrated that the ice
accretion is acceptable after a representative delay in the selection of the ice-protection systems, such as
might occur during inadvertent entry into the conditions. In lack of other evidence a delay of two minutes (to
switch on the system) should normally be achieved. The time for the system to warm up should be
represented.
2.4.4 For each test, the ice protection supply should be representative of the minimum engine power for
which satisfactory operation in icing conditions is claimed.
2.4.5 If at the conclusion of each of the tests of 2.4.2 there is excessive ice accretion then the heat flow
and airflow should be changed simultaneously to simulate an engine acceleration to demonstrate the pattern
of ice shedding, which should be acceptable to the engine.
2.4.6 Where the minimum engine power necessary to provide adequate protection (as established in
2.4.2) is greater than that required for descent, an additional test representative of the minimum engine
power associated with descent should be conducted by means of either –
a. A run at the –10°C condition of Table 1, column (a), for sufficient duration to cover an anticipated
descent of 3048 m (10 000 ft), or
b. A run simulating an actual descent, at the conditions of Table 1 column (a), covering an altitude
change of not less than 3048 m (10 000 ft), the highest total temperature reached being not more than 0°C.
2.4.7 If at the conclusion of the test in 2.4.6 there is excessive ice accretion then the heat flow and airflow
should be changed simultaneously to simulate an engine acceleration and the ambient temperature should
be increased to above 0°C to demonstrate the pattern of total ice shedding which should be acceptable to
the engine.
2.4.8 If the intake contains features or devices which could be affected by freezing fog conditions then in
addition to the above tests of 2.4.2, 2.4.3 and 2.4.6 a separate test on these parts should be conducted for a
duration of 30 minutes, in an atmosphere of –2°C and a liquid water concentration of 0·3 g/m 3, with the heat
supply to the tested part as would be available with the engine set to the minimum ground idle conditions
approved for use in icing. The mean effective droplet size for the test should be 20 µm. At the end of the
period the ice accretion on the tested part should not prevent its proper functioning, nor should the ice be of
such size as to hazard the engine if shed.
3 Method 2 (Interpretative Material)
3.1 In establishing compliance with the requirements of CS 25.1093(b), reference should be made to
CS 25.1419 and AMC 25.1419.
3.2 The intake may be tested with the engine and propeller where appropriate in accordance with a
programme of tests which results from an analysis of the icing conditions and the engine conditions
appropriate to the installation.
3.3 When the intake is assessed separately it should be shown that the effects of intake icing would not
invalidate any engine certification tests. Factors to be considered in such evaluation are –
3.5 Following the analysis required in CS 25.1419(b), which will determine the critical icing conditions
within the envelope of icing conditions defined by Appendix C Figures 1 to 3 and Appendix C Figures 4 to 6,
2-E-8
BOOK 2 CS–25
tests should be conducted at such conditions as are required to demonstrate the adequacy of the design
points.
3.6 It should be demonstrated that the ice accretion is acceptable after a representative delay in the
selection of the ice protection systems, such as might occur during inadvertent entry into the conditions. In
lack of other evidence a delay of two minutes (to switch on the system) should normally be achieved in
continuous maximum icing conditions. The time for the system to warm up should be represented.
3.7 If at the conclusion of each of the tests there is excessive ice accretion then the heat flow and
airflow should be changed simultaneously to simulate an engine acceleration to demonstrate the pattern of
ice shedding, which should be acceptable to the engine.
3.8 Where the minimum engine power necessary for adequate protection as established above is
greater than that required for descent, this should be considered in the analysis, and test evidence may have
to be provided to demonstrate acceptability. The icing conditions and vertical extent are as in Figure 1 of
Appendix C. Any ice able to be shed from the intake into the engine should be acceptable to the engine.
3.9 If the intake contains features or devices which could be affected by freezing fog conditions then a
separate assessment for these parts should be conducted assuming a duration of 30 minutes and an
atmosphere of –2°C, and a liquid water concentration of 0·3 g/m3, with the heat supply to the tested part as
would be available with the engine set to the minimum ground idle conditions approved for use in icing. The
mean effective droplet size should be 20 µm. At the end of the period the ice accretion on the part should
not prevent its proper functioning, nor should the ice be of such size as to hazard the engine if shed.
AMC 25.1103(d)
Air Intake System Ducts
For a single failure case leading to a fire and air duct rupture, consideration should be given to the possibility
of fire aggravation due to air flowing into a designated fire zone of an engine from the remaining engine(s),
or another source outside the affected fire zone.
AMC 25.1121(a)
General
1 If necessary, each exhaust system should be provided with drains to prevent hazardous
accumulation of fuel under all conditions of operation.
2 Tests should be made to demonstrate compliance with CS 25.1121(a) and these should include
engine starting in downwind conditions and thrust reversal.
AMC 25.1121(b)
General
Leakage should be interpreted to include fuel discharged from the jet pipe under false start conditions both
on the ground and in flight. It should be demonstrated that successive attempts to restart do not create a fire
hazard. The maximum time for complete drainage of fuel following a false start should be established. This
period will be used to determine the minimum interval between start attempts.
AMC 25.1125(a)(3)
Exhaust Heat Exchangers
The cooling provisions should be arranged so that it is not possible to use the heat exchanger unless the
cooling provisions are in operation.
2-E-9
CS–25 BOOK 2
AMC 25.1141(f)
Powerplant Controls, General
A continuous indicator need not be provided.
AMC 25.1155
Reverse Thrust and Propeller Pitch Settings Below the Flight Regime
1. PURPOSE. This AMC provides guidance for demonstrating compliance with the certification
requirement relating to controls which regulate reverse thrust or propeller pitch settings below the flight
regime on Large Aeroplanes.
2. RELATED CERTIFICATION SPECIFICATIONS.
Paragraphs which prescribe requirements for the design, substantiation, and certification relating to the
control of reverse thrust and propeller pitch settings below the flight regime of Large Aeroplanes include:
§25.777 Cockpit Controls.
§25.779 Motion and effect of cockpit controls
3. APPLICABILITY.
The basic provisions of CS 25.1155 require that the control for selecting reverse thrust (propeller pitch
settings below the flight regime) have a positive lock or stop at the flight idle position as well as separate and
distinct operation by the flight crew to displace the control from the in-flight regime. These basic provisions
are applicable to all Large Aeroplanes.
The specific provisions of CS 25.1155 are applicable to the control system protecting against the intentional
or the inadvertent in-flight selection of the thrust reverser for turbojet powered airplanes or propeller
operation at pitch settings below the flight regime for turboprop powered airplanes. However, the specific
provisions would not be applicable to a turbojet powered airplane whose reverser was certified for in-flight
use or to a turbo-propeller powered airplane whose propellers were certified for pitch settings below the
normal in-flight operating regime.
In addition to the 25.1155 applicability limitations noted above, the intentional selection provisions should not
be interpreted to include a pilot who knowingly gains in-flight access to the prohibited engine control regime
by:
a) disabling a protective control system (i.e. throttle baulk or warning) by pulling circuit breaker, or
b) ignoring a clearly annunciated protective control system failure warning or caution message.
2-E-10
BOOK 2 CS–25
4. BACKGROUND.
CS 25.1155 was derived from the equivalent FAA rule and therefore the requirement history below relates to
the development of FAR 25.1155. Also the operational occurrences and the development of continued
airworthiness solutions mentioned below, are based, largely, on the U.S experience.
a. Requirement History. The requirements to guard against inadvertent operation of both cockpit
mounted propeller and turbojet reverse control lever(s) date back to CAR 4b (4b.474a). When part 25 was
codified in 1965, only the turbojet reverse section of the subject requirement was retained as FAR §25.1155.
In 1967, Amendment 25-11 broadened §25.1155 to once again include protection against inadvertent in-
flight operation of thrust reversers and propeller pitch settings below the flight regime. This Amendment
required the cockpit propeller control to incorporate positive locks or stops at the flight idle position, and
further specified that the control means must require a separate and distinct operation by the crew, in order
to displace the propeller control from the flight regime.
b. Operational Experience - Turbo-propeller powered Airplanes. In-service experience during the late
1980s and 1990s of some turbo-propeller powered transport category airplanes, has shown that intentional
or inadvertent in-flight operation of the propeller control systems below flight idle has produced two types of
hazardous, and in some cases, catastrophic conditions:
(i) Permanent engine damage and total loss of thrust on all engines when the propellers that were operating
below the flight regime drove the engines to over-speed, and;
(ii) Loss of airplane control because at least one propeller operated below the flight regime during flight
creating asymmetric control conditions.
As a result of this unsatisfactory service experience, in-flight beta lockout systems were retroactively
required (via Airworthiness Directives) on several transport category turboprop airplanes. These beta lock-
out systems were required only after it was determined that increased crew training, installation of cockpit
placards warning crews not to use beta in flight, and stronger wording in AFM warnings and limitations did
not preclude additional in-flight beta events.
In addition to the continued airworthiness issues noted above, the FAA also recognized the need to update
the FAR requirement to require some form of design improvements for new airplanes. {NOTE: RWB
additional words to complete the sentence.} Until the rule changes noted above are complete, the FAA is
using the no unsafe feature or characteristic provisions of 21.21(b)(2) to require installation of beta lockout
systems on new transport category turbo-propeller powered airplanes.
Intentional selection of beta mode/reverse in flight for rapid aircraft deceleration was not specifically
addressed by this regulation. Also, FAR 25.933(b) had been interpreted as not requiring, for turbo-propeller
aircraft, an interlock or other automatic device to prohibit movement of the power lever by the flight crew
below the flight idle stop when the aircraft is in flight.
Consequently, initial FAA certification of transport category turbo-propeller aircraft has not required an in-
flight beta lockout device to prevent intentional selection of the beta mode/reverse in flight.
Typical beta lockout systems currently use wheel spin-up, squat switch activation, gear-up switch activation,
or combinations of these. Certain airplanes, especially those with low wings and without ground spoilers,
have a tendency to float during landing. In the case of these airplanes, the application of beta may be
delayed on a wet runway because, while the airplane is floating, the ground logic or the wheel spin-up may
not activate immediately.
Landing performance of turbo-propeller-powered airplanes is based on ground idle availability, which is part
of the beta range. Turbo-propeller-powered airplanes landing on field length-limited runways with delayed
beta application present a potential hazard. Overruns are more likely to occur if operating under part 91 (un-
factored field lengths); however, the risks are also present if operating under parts 121 or 135 (factored field
lengths) on a wet runway. Paragraph (b) of the rule prohibits override, however, there are several acceptable
methods that may be used to overcome the deficiencies of the squat switch or wheel spin-up logic alone,
such as the use of a radar altimeter or multiple air/ground logic inputs.
c. Operational Experience - Turbo-jet (Turbo-fan) Powered Airplanes. For turbojet (turbofan) thrust
reversers, there has not been such a bad accident experience of pilot initiated thrust reverser deployment as
for the turbo-propeller airplanes, but they have occurred. There has also been a number of reported cases,
where the thrust reversers have been selected before touch down, in order to minimize the landing roll. In
2-E-11
CS–25 BOOK 2
these cases, the provision of a weight-on-wheels (WOW) interlock as part of the thrust reverser design,
prevented the deployment of the reverser. However, the basic concern about the need to avoid a reversing
condition, outside any approved operating regime, is the same for a thrust reverser equipped aircraft, as it is
for a propeller powered aircraft i.e. the prevention of Catastrophic failure conditions.
§25.933(a) and its AC / AMC describe means by which the thrust reverser system can be shown to have
sufficient system integrity, to meet the required Safety Objectives. If the reliability method of compliance with
§25.933(a) is used, the probability of an unwanted reverser deployment in flight will be shown to be <1E-09.
In this case, where very low probabilities of system failures are demonstrated, it was considered to be
inappropriate that a single event of pilot selection could cause the same effect, - a reverser deployment.
Recognition that occurrences of thrust reverser selection in flight have occurred, reinforced by the growing
perception that human factors need to be considered, has resulted in thrust reverser controls being
considered equally. This approach ensures consistency in the application of §25.1155 to both turbo-prop and
turbo-jet (turbo-fan) reversing systems.
The design objective sought by §25.1155 has been a common design practice for many turbo-jet (turbofan)
thrust reverser designs. This rule establishes that a means to prevent crew selection or activation of reverse
thrust or propeller pitch settings below the flight regime must be provided, as the minimum required
standard.
d. Override Systems. Historically, some turbo-propeller systems have been provided with an override
capability, such that on landing, if the selection of pitch below flight idle is not successful - because of
system failures or because signals used in the system may not have transitioned to the ground mode - the
flight crew could select the override function to enable use of pitch below flight idle during ground operation.
As mentioned above, many turbo-jet (turbofan) powered airplanes equipped with thrust reversers have
utilized weight-on-wheels, or other air-ground logic, to prevent selection or activation of thrust reversers in
flight. Generally, these systems have been capable of successful operation, despite not being equipped with
any form of over-ride. It is the intention of the revised version of §25.1155 to prevent any selection or
activation of propeller pitch below the flight regime or reverse thrust in flight. The provision of any override,
which would allow selection or activation of propeller pitch below the flight regime or reverse thrust out the
approved in flight envelope for that function would not comply with the §25.1155. The design of the system
to show compliance with §25.1155 will need to take into account the Safety Objectives associated with the
maintenance of the required landing performance.
5. DEFINITIONS.
a. Approved in-flight operating envelope. An area of the Normal Flight Envelope where a function has
been accepted as suitable by the Authorities.
f. Inadvertent. Action performed by the pilot who did not mean to do it.
g. In-flight. That part of aeroplane operation beginning when the wheels are no longer in contact with
the ground during the takeoff and ending when the wheels again contact the ground during landing.
h. Intentional. Action performed by the pilot who meant to do it
i. Propeller pitch control system. All those system components which enable the flight crew to
command and control propeller pitch
j. Remote. See AMC 25.1309.
k. Reverse control system. All those system components which enable the flight crew to command
and control the thrust reverser
l.. Separate and distinct. More than or in addition to a continuation of motion required for
movement and obvious to each member of the flight crew
2-E-12
BOOK 2 CS–25
m. Thrust Reversal. A movement of all or part of the thrust reverser from the forward thrust position to
a position that spoils or redirects the engine airflow.
n. Turbojet (or turbofan). A gas turbine engine in which propulsive thrust is developed by the
reaction of gases being directed through a nozzle.
o. Turbo-propeller. A gas turbine engine in which propulsive thrust is developed by the propeller
c. Separate and distinct. To move cockpit controls from the Flight Idle position must require a
separate and distinct operation of the control to pass from the Flight Idle position to positions approved only
for ground operation. The control must also have features to prevent inadvertent movement of the control
through the Flight Idle position. It must only be possible to make this separate and distinct operation once
the control has reached the Flight Idle position.
Separate and distinct is more than or in addition to a continuation of motion required for movement to the Flight
Idle setting and must be obvious to the flight crew.
Examples of separate and distinct controls that have been used in previous designs are as follows:
i) Physically separate forward/reverse [below flight idle] control levers or mechanisms.
ii) Manually actuated latches located on or in the vicinity of the control that cannot be actuated until
Flight Idle.
iii) A required change in direction of operation of the control from that needed for movement to
Flight Idle.
Examples of separate and distinct control operation, which would not be acceptable include:
i) a separate operation, which can be activated away from the Flight Idle position, so that
movement of the control from forward thrust to below the flight regime or thrust reversal can be
accomplished with a single action.
ii) any separate operation, where latches or equivalent devices can be pre-loaded by the pilot so
that a single movement of the control, enables movement below flight idle.
iii) any control arrangement, where it can be ascertained that normal wear and tear could cause the
separate and distinct action to be lost.
d. Cockpit indications. The overall indication requirements for Thrust Reverser Control System and
Propeller Pitch Control System are given in the CS 25.933, 25.1305(d)(2), 25.1309(c), 25.1322, and
25.1337(e) paragraphs and their associated AMCs. The following text adds some specific guidance with
respect to the requirements of paragraph CS 25.1155(d) and (e).
Sub-paragraphs “(d)” and “(e)” of the rule require crew cautions to be provided for two conditions:
“(d)” when the means ‘to prevent both inadvertent and intentional selection of propeller pitch settings
below the flight regime (thrust reversal for turbo-jet powered airplanes) when out of the approved in-flight
operating envelope for that function’ is lost. The purpose of this caution is to inform the flight crew that a fault has
occurred to the propeller pitch control system or the thrust reverser control system, so that the protection means
is no longer available and any movement of the control below the flight regime (forward thrust regime) may cause
a low pitch/high drag condition or thrust reverser deployment. With this information, the flight crew will be able to
take appropriate precautions, as advised by approved Manuals and reinforced by their training, to minimise the
possibility of a hazardous condition. Without this caution, a fault in the protection means could allow an unsafe
2-E-13
CS–25 BOOK 2
condition to occur, whereby any inadvertent or intentional movement of the control below the flight regime could
cause a hazardous low pitch or reverse thrust condition.
“(e)” when the cockpit control is displaced from the flight regime (forward thrust for turbo-jet powered
airplanes) into a position to select propeller pitch settings below the flight regime (thrust reversal for turbo-jet
powered airplanes) and the airplane is outside the approved in-flight operating envelope for that function. On
some anticipated system designs, the pilot will have the ability to move the cockpit control below the flight regime
(into thrust reverse for turbo-jet powered airplanes) with no restriction, other than the ‘separate and distinct
operation’ required by CS 25.1155(a). For this type of design, the means to prevent propeller pitch settings below
the flight regime (reverse thrust for turbo-jet powered airplanes) when out of the approved in-flight operating
envelope for that function will be a part of the propeller pitch control system or the thrust reverser system. Whilst
there is no immediate hazard at that point, the control is not in the proper position for flight operations and the
flight crew need to be made aware of that situation, so that they can take the appropriate action. In some of the
accidents, where the control had been moved into the ‘below flight ‘ regime, it was not clear whether this control
movement had been inadvertent or intentional. Provision of this caution will give the crew a clear indication of any
incorrect placement of the control however the control was positioned. For any design, where there is approval for
selection of propeller pitch settings below the flight regime (reverse thrust for turbo-jet powered airplanes), there
will be no need to provide this caution when the aircraft is in the approved in-flight operating envelope for that
function. Also, as made clear in CS 25.1155(e), there is no requirement to provide any caution for control
movement, when on the ground.
e. Reliability considerations. The intention of CS 25.1155(b) is for the aircraft design to include a
means to prevent the flight crew selecting (or activating) propeller pitch settings below the flight regime or
reverser deployment, when the aircraft is not in the approved in-flight operating envelope for that function.
The introduction of the rule stems directly from a number of cases, where such a selection has caused
accidents. Because of a large variability in the current perception of the future occurrence rate for this type
of flight crew error, a target reliability level for the prevention means is included in the rule, see CS
25.1155(c). This level of reliability is expected to give a high degree of protection from the unwanted
selection or activation of low propeller pitch or reverser deployment. The provision of the cautions should
provide the necessary safeguard, on the few occasions when the prevention means fails. Additionally, this
target safety level should not be inconsistent with the required availability of the reversing function for
landing performance.
The safety assessment methods established by CS 25.901(c) and CS 25.1309(b) are appropriate for the
determination of the reliability level required by CS 25.1155(c) and for assessing the effects of any other
failure conditions or malfunctions.
f. Reverser/pitch below flight regime availability on ground. Landing or Aborted take-off distances on
wet runways usually take credit for the braking effect created by reverse thrust or propeller pitch below flight
idle. Therefore availability of these systems when in the approved operating envelope must be maintained.
It must therefore be shown that failures in the system provided to meet CS 25.1155(b) do not degrade
significantly the availability of the reverse thrust or low pitch selection on ground.
7. INSTRUCTIONS FOR CONTINUED AIRWORTHINESS.
a. Manufacturing/Quality. Due to the criticality of the reverse thrust function or pitch below flight
regime function, manufacturing and quality assurance processes should be assessed and implemented, as
appropriate, to ensure the design integrity of the critical components.
b. Maintenance and Alterations. Reference to CS 25.901(b)(2) and CS 25.1529/Appendix H. The
criticality of the control system requires that maintenance and maintainability be emphasized in the design
process and derivation of the maintenance control program, as well as subsequent field maintenance,
repairs, or alterations.
c. Manuals- Limitations/Procedures. Prohibition of use of reverse thrust or pitch settings below the
flight regime when outside the approved in-flight operating envelope for that function should be introduced in
AFM.
Cautions as described in 1155(d) and (e) and their related procedures should be included in the Operations
Manual.
2-E-14
BOOK 2 CS–25
AMC 25.1181
Designated Fire Zones
1 ISO 2685, (15 JULY 1992) ‘Aircraft – Environmental conditions and test procedures for airborne
equipment – Resistance to fire in designated fire zones’, gives test conditions and methods of demonstrating
compliance with the ‘Fire-resistant’ and ‘Fireproof’ requirements.
2 Tests to demonstrate compliance with the standard grades of resistance to fire may not be
necessary if similarity can be shown with other components which have been tested in accordance with this
standard.
3 For example, materials which are considered satisfactory for use in firewalls without being subjected
to fire tests include –
a. Stainless steel sheet 0·4 mm (0·016 in) thick;
b. Mild steel sheet protected against corrosion 0·45 mm (0·018 in) thick; and
c. Titanium sheet 0·45 mm (0·018 in) thick.
AMC 25.1195(b)
Fire Extinguisher Systems
Acceptable methods to establish the adequacy of the fire extinguisher system are laid down in Advisory
Circular 20-100.
2-E-15
CS–25 BOOK 2
2-E-16
BOOK 2 CS-25
AMC – SUBPART F
AMC 25.1301(b)
Function and Installation
1 Adequate means of identification should be provided for all cables, connectors and terminals. The
means employed should be such as to ensure that the identification does not deteriorate under service
conditions.
2 When pipelines are marked for the purpose of distinguishing their functions, the markings should be
such that the risk of confusion by maintenance or servicing personnel will be minimised. Distinction by
means of colour markings alone is not acceptable. The use of alphabetic or numerical symbols will be
acceptable if recognition depends upon reference to a master key and any relation between symbol and
function is carefully avoided. Specification ISO.12 version 2ED 1987 gives acceptable graphical markings.
AMC 25.1303(b)(5)
Attitude Displays
1 Attitude Displays
1.1 For turbo-jet aeroplanes each display should be usable over the full range of 360° in pitch and in
roll. For propeller-driven aeroplanes the pitch range may be reduced to ± 75° provided that no misleading
indication is given when the limiting attitude is exceeded.
1.2 Paragraph 1.1 is not intended to prohibit the use of vertical references having controlled gyro
precession, or its equivalent in the case of a stable platform, but precession should not occur at a pitch
attitude closer to the horizontal than 70°, and should be completed within an attitude change of 15°.
1.3 The display should take the form of an artificial horizon line, which moves relative to a fixed
reference aeroplane symbol so as to indicate the position of the true horizon.
NOTES:
1 It is acceptable for the fixed reference aeroplane symbol to be positioned so that it is aligned with
the horizon line during cruising flight.
2 If a variable index is provided in addition to the fixed aeroplane symbol it should be so designed that
it will not introduce any risk of misinterpretation of the display.
1.4 There should be no means accessible to the flight crew of adjusting the relationship between the
horizon line and the reference aeroplane symbol.
1.5 The artificial horizon line should move in roll so as to remain parallel to the true horizon, i.e. when
the aeroplane rolls through an angle of 30° the artificial horizon line should also rotate through 30° relative to
the fixed index.
1.6 The artificial horizon line should remain in view over a range of pitch attitudes sufficient to cover all
normal operation of the aeroplane plus a margin of not less than 2° in either direction. Additional ‘ghost’
horizon lines should be provided parallel to the main horizon line so that beyond this range at least one such
line is in view at an attitude with the range of the display.
1.7 The pitch attitude scale should be sensibly linear while the main horizontal line is in view, but may
become non-linear beyond this range.
All the attitude displays in the aeroplane should have a similar presentation so as to prevent any risk of
confusion in transferring attention from one display to another.
1.9 Sufficient pitch and bank angle graduations and markings should be provided to allow an acceptably
accurate reading of attitude and to minimise the possibility of confusion at extreme attitudes.
2-F-1
CS-25 BOOK 2
1.10 A bank angle index and scale should be provided. The index may be on the fixed or moving part of
the display.
1.11 The ‘earth’ and ‘sky’ areas of the display should be of contrasting colours or shades. The
distinction should not be lost at any pitch or roll angle.
1.12 Any additional information (e.g. flight director commands) displayed on an attitude display should
not obscure or significantly degrade the attitude information.
1.13 The display should be clearly visible under all conditions of daylight and artificial lighting.
1.14 Words that may be ambiguous (e.g. ‘climb’, ‘dive’, ‘push’, ‘pull’) should not be used.
2 Attitude Display Systems (Acceptable Means of Compliance)
2.1 The probability of indication of dangerously incorrect information without a warning being given
should be Extremely Remote.
2.2 The warning may be provided by means of self- or comparison-monitoring and should be clear and
unambiguous, e.g. a flashing light. Instrument flags are unlikely to be acceptable as a comparator warning
unless they exclude a significant portion of the display in which case means should be provided to permit the
removal of the flag from the display, which is not in error.
2.3 The definition of dangerously incorrect information depends to some extent on the characteristics of
the aeroplane, but in general an error greater than 5° in pitch or 10° in roll will be considered to be
dangerous.
AMC 25.1303(c)(1)
Flight and Navigation Instruments
In the absence of warning through the inherent aerodynamic qualities of the aeroplane (e.g. buffeting) it
should be shown that no single faults can result both in misleading airspeed information and in operation of
the warning system outside its tolerances, such as would be likely to lead to exceedance of VMO/MMO.
AMC 25.1305(d)(1)
Powerplant Instruments
The following are examples of parameters, which are considered to be directly related to thrust; fan
RPM(N1), integrated engine pressure ratio (IEPR) and engine pressure ratio (EPR), depending on engine
type.
AMC 25.1309
System Design and Analysis
1. PURPOSE.
a. This AMC describes acceptable means for showing compliance with the requirements of CS 25.1309.
These means are intended to provide guidance to supplement the engineering and operational judgement
that must form the basis of any compliance demonstration.
b. The extent to which the more structured methods and guidelines contained in this AMC should
be applied is a function of systems complexity and systems failure consequence. In general, the extent and
structure of the analyses required to show compliance with CS 25.1309 will be greater when the system is
more complex and the effects of the Failure Conditions are more severe. This AMC is not intended to require
that the more structured techniques introduced in this revision be applied where traditional techniques have
been shown to be acceptable for more traditional systems designs. The means described in this AMC are
not mandatory. Other means may be used if they show compliance with CS 25.1309.
2. RESERVED.
2-F-2
BOOK 2 CS-25
3. RELATED DOCUMENTS.
(3) AC 20-115B Radio Technical Commission for Aeronautics Document RTCA DO-178B/AMC 20-115B
EUROCAE ED-12B.
b. Industry documents.
(1) RTCA, Inc., Document No. DO-160D/EUROCAE ED-14D, Environmental Conditions and Test
Procedures for Airborne Equipment.
(2) RTCA, Inc., Document No. DO-178B/EUROCAE ED-12B, Software Considerations in Airborne
Systems and Equipment Certification.
(3) Society of Automotive Engineers (SAE) Aerospace Recommended Practice (ARP) 4754/EUROCAE
ED-79, Certification Considerations for Highly Integrated or Complex Aircraft Systems.
(4) Society of Automotive Engineers (SAE) Aerospace Recommended Practice (ARP) 4761, Guidelines
and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment.
4. APPLICABILITY OF CS 25.1309.
Paragraph 25.1309 is intended as a general requirement that should be applied to any equipment or system
as installed, in addition to specific systems requirements, except as indicated below.
a. While CS 25.1309 does not apply to the performance and flight characteristics of Subpart B and
structural requirements of Subparts C and D, it does apply to any system on which compliance with any of
those requirements is based. For example, it does not apply to an aeroplane's inherent stall characteristics
or their evaluation, but it does apply to a stall warning system used to enable compliance with CS 25.207.
b. Certain single failures or jams covered by CS 25.671(c)(1) and CS 25.671(c)(3) are accepted from the
requirements of CS 25.1309(b)(1)(ii). FAR 25.671(c)(1) requires the consideration of single failures,
regardless of the probability of the failure. CS 25.671(c)(1) does not consider the effects of single failures if
their probability is shown to be extremely improbable and the failures also meet the requirements of
CS 25.571(a) and (b).
c. Certain single failures covered by CS 25.735(b)(1) are accepted from the requirements of CS 25.1309(b).
The reason concerns the brake system requirement that limits the effect of a single failure to doubling the
brake roll stopping distance. This requirement has been shown to provide a satisfactory level of safety
without the need to analyse the particular circumstances and conditions under which the single failure
occurs.
d. The failure effects covered by CS 25.810(a)(1)(v) and CS 25.812 are accepted from the requirements of
CS 25.1309(b). The Failure Conditions associated with these cabin safety equipment installations are
associated with varied evacuation scenarios for which the probability cannot be determined. It has not been
proven possible to define appropriate scenarios under which compliance with CS 25.1309(b) can be
demonstrated. It is therefore considered more practical to require particular design features or specific
2-F-3
CS-25 BOOK 2
reliability demonstrations and except these items of equipment from the requirements of CS 25.1309(b).
Traditionally, this approach has been found to be acceptable.
e. The requirements of CS 25.1309 are generally applicable to engine, propeller, and propulsion system
installations. The specific applicability and exceptions are stated in CS 25.901(c).
f. Some systems and some functions already receive an evaluation to show compliance with specific
requirements for specific Failure Conditions and therefore meet the intent of CS 25.1309 without the need
for additional analysis for those specific Failure Conditions.
5. DEFINITIONS.
The following definitions apply to the system design and analysis requirements of CS 25.1309 and the
guidance material provided in this AMC. They should not be assumed to apply to the same or similar terms
used in other regulations or AMCs. Terms for which standard dictionary definitions apply are not defined
herein.
a. Analysis. The terms "analysis" and "assessment" are used throughout. Each has a broad definition and
the two terms are to some extent interchangeable. However, the term analysis generally implies a more
specific, more detailed evaluation, while the term assessment may be a more general or broader evaluation
but may include one or more types of analysis. In practice, the meaning comes from the specific application,
e.g., fault tree analysis, Markov analysis, Preliminary System Safety Assessment, etc.
c. Average Probability Per Flight Hour. For the purpose of this AMC, is a representation of the number of
times the subject Failure Condition is predicted to occur during the entire operating life of all aeroplanes of
the type divided by the anticipated total operating hours of all aeroplanes of that type (Note: The Average
Probability Per Flight Hour is normally calculated as the probability of a Failure Condition occurring during a
typical flight of mean duration divided by that mean duration).
d. Candidate Certification Maintenance Requirements (CCMR). A periodic maintenance or flight crew check
may be used in a safety analysis to help demonstrate compliance with CS 25.1309(b) for Hazardous and
Catastrophic Failure Conditions. Where such checks cannot be accepted as basic servicing or airmanship
they become Candidate Certification Maintenance Requirements (CCMRs). AMC 25.19 defines a method by
which Certification Maintenance Requirements (CMRs) are identified from the candidates. A CMR becomes
a required periodic maintenance check identified as an operating limitation of the type certificate for the
aeroplane.
e. Check. An examination (e.g., an inspection or test) to determine the physical integrity and/or functional
capability of an item.
f. Complex. A system is Complex when its operation, failure modes, or failure effects are difficult to
comprehend without the aid of analytical methods.
h. Design Appraisal. This is a qualitative appraisal of the integrity and safety of the system design.
i. Development Assurance. All those planned and systematic actions used to substantiate, to an adequate
level of confidence, that errors in requirements, design, and implementation have been identified and
corrected such that the system satisfies the applicable certification basis.
2-F-4
BOOK 2 CS-25
k. Event. An occurrence which has its origin distinct from the aeroplane, such as atmospheric conditions
(e.g. gusts, temperature variations, icing and lightning strikes), runway conditions, conditions of
communication, navigation, and surveillance services, bird-strike, cabin and baggage fires. The term is not
intended to cover sabotage.
l. Failure. An occurrence, which affects the operation of a component, part, or element such that it can no
longer function as intended, (this includes both loss of function and malfunction). Note: Errors may cause
Failures, but are not considered to be Failures.
m. Failure Condition. A condition having an effect on the aeroplane and/or its occupants, either direct or
consequential, which is caused or contributed to by one or more failures or errors, considering flight phase
and relevant adverse operational or environmental conditions, or external events.
n. Installation Appraisal. This is a qualitative appraisal of the integrity and safety of the installation. Any
deviations from normal, industry-accepted installation practices, such as clearances or tolerances, should be
evaluated, especially when appraising modifications made after entry into service.
o. Latent Failure. A failure is latent until it is made known to the flight crew or maintenance personnel. A
significant latent failure is one, which would in combination with one or more specific failures, or events
result in a Hazardous or Catastrophic Failure Condition.
p. Qualitative. Those analytical processes that assess system and aeroplane safety in an objective, non-
numerical manner.
q. Quantitative. Those analytical processes that apply mathematical methods to assess system and
aeroplane safety.
r. Redundancy. The presence of more than one independent means for accomplishing a given function or
flight operation.
s. System. A combination of components, parts, and elements, which are inter-connected to perform one or
more functions.
6. BACKGROUND
a. General.
For a number of years aeroplane systems were evaluated to specific requirements, to the "single fault"
criterion, or to the fail-safe design concept. As later-generation aeroplanes developed, more safety-critical
functions were required to be performed, which generally resulted in an increase in the complexity of the
systems designed to perform these functions. The potential hazards to the aeroplane and its occupants
which could arise in the event of loss of one or more functions provided by a system or that system's
malfunction had to be considered, as also did the interaction between systems performing different
functions. This has led to the general principle that an inverse relationship should exist between the
probability of a Failure Condition and its effect on the aeroplane and/or its occupants (see Figure 1). In
assessing the acceptability of a design it was recognised that rational probability values would have to be
established. Historical evidence indicated that the probability of a serious accident due to operational and
airframe-related causes was approximately one per million hours of flight. Furthermore, about 10 percent of
the total were attributed to Failure Conditions caused by the aeroplane's systems. It seems reasonable that
serious accidents caused by systems should not be allowed a higher probability than this in new aeroplane
designs. It is reasonable to expect that the probability of a serious accident from all such Failure Conditions
-7
be not greater than one per ten million flight hours or 1 x 10 per flight hour for a newly designed aeroplane. The
difficulty with this is that it is not possible to say whether the target has been met until all the systems on the
aeroplane are collectively analysed numerically. For this reason it was assumed, arbitrarily, that there are
about one hundred potential Failure Conditions in an aeroplane, which could be Catastrophic. The target
-7
allowable Average Probability per Flight Hour of 1 x 10 was thus apportioned equally among these Failure
2-F-5
CS-25 BOOK 2
Conditions, resulting in an allocation of not greater than 1 x 10-9 to each. The upper limit for the Average
Probability per Flight Hour for Catastrophic Failure Conditions would be 1 x 10-9 , which establishes an approximate
probability value for the term "Extremely Improbable". Failure Conditions having less severe effects could be
relatively more likely to occur.
The Part 25 airworthiness standards are based on, and incorporate, the objectives and principles or
techniques of the fail-safe design concept, which considers the effects of failures and combinations of
failures in defining a safe design.
(i) In any system or subsystem, the failure of any single element, component, or connection during any one
flight should be assumed, regardless of its probability. Such single failures should not be Catastrophic.
(ii) Subsequent failures during the same flight, whether detected or latent, and combinations thereof, should
also be assumed, unless their joint probability with the first failure is shown to be extremely improbable.
(2) The fail-safe design concept uses the following design principles or techniques in order to ensure a safe
design. The use of only one of these principles or techniques is seldom adequate. A combination of two or
more is usually needed to provide a fail-safe design; i.e. to ensure that Major Failure Conditions are Remote,
Hazardous Failure Conditions are Extremely Remote, and Catastrophic Failure Conditions are Extremely
Improbable:
(i) Designed Integrity and Quality, including Life Limits, to ensure intended function and prevent failures.
(ii) Redundancy or Backup Systems to enable continued function after any single (or other defined number
of) failure(s); e.g., two or more engines, hydraulic systems, flight control systems, etc.
(iii) Isolation and/or Segregation of Systems, Components, and Elements so that the failure of one does not
cause the failure of another.
(iv) Proven Reliability so that multiple, independent failures are unlikely to occur during the same flight.
(vi) Flight crew Procedures specifying corrective action for use after failure detection.
(viii) Designed Failure Effect Limits, including the capability to sustain damage, to limit the safety impact or
effects of a failure.
(ix) Designed Failure Path to control and direct the effects of a failure in a way that limits its safety impact.
(x) Margins or Factors of Safety to allow for any undefined or unforeseeable adverse conditions.
(xi) Error-Tolerance that considers adverse effects of foreseeable errors during the aeroplane's design, test,
manufacture, operation, and maintenance.
(1) A concern arose regarding the efficiency and coverage of the techniques used for assessing safety
aspects of highly integrated systems that perform complex and interrelated functions, particularly through
the use of electronic technology and software based techniques. The concern is that design and analysis
techniques traditionally applied to deterministic risks or to conventional, non-complex systems may not
2-F-6
BOOK 2 CS-25
provide adequate safety coverage for more complex systems. Thus, other assurance techniques, such as
development assurance utilising a combination of process assurance and verification coverage criteria, or
structured analysis or assessment techniques applied at the aeroplane level, if necessary, or at least across
integrated or interacting systems, have been applied to these more complex
systems. Their systematic use increases confidence that errors in requirements or design, and integration
or interaction effects have been adequately identified and corrected.
(2) Considering the above developments, as well as revisions made to the CS 25.1309, this AMC was
revised to include new approaches, both qualitative and quantitative, which may be used to assist in
determining safety requirements and establishing compliance with these requirements, and to reflect
revisions in the rule, considering the whole aeroplane and its systems. It also provides guidance for
determining when, or if, particular analyses or development assurance actions should be conducted in the
frame of the development and safety assessment processes. Numerical values are assigned to the
probabilistic terms included in the requirements for use in those cases where the impact of system failures is
examined by quantitative methods of analysis. The analytical tools used in determining numerical values are
intended to supplement, but not replace, qualitative methods based on engineering and operational
judgement.
a. Classifications. Failure Conditions may be classified according to the severity of their effects as follows:
(1) No Safety Effect: Failure Conditions that would have no effect on safety; for example, Failure Conditions
that would not affect the operational capability of the aeroplane or increase crew workload.
(2) Minor: Failure Conditions which would not significantly reduce aeroplane safety, and which involve crew
actions that are well within their capabilities. Minor Failure Conditions may include, for example, a slight
reduction in safety margins or functional capabilities, a slight increase in crew workload, such as routine
flight plan changes, or some physical discomfort to passengers or cabin crew.
(3) Major: Failure Conditions which would reduce the capability of the aeroplane or the ability of the crew to
cope with adverse operating conditions to the extent that there would be, for example, a significant reduction
in safety margins or functional capabilities, a significant increase in crew workload or in conditions impairing
crew efficiency, or discomfort to the flight crew, or physical distress to passengers or cabin crew, possibly
including injuries.
(4) Hazardous: Failure Conditions, which would reduce the capability of the aeroplane or the ability of the
crew to cope with adverse operating, conditions to the extent that there would be:
(ii) Physical distress or excessive workload such that the flight crew cannot be relied upon to perform their
tasks accurately or completely; or
(iii) Serious or fatal injury to a relatively small number of the occupants other than the flight crew.
(5) Catastrophic: Failure Conditions, which would result in multiple fatalities, usually with the loss of the
aeroplane. (Note: A “Catastrophic” Failure Condition was defined in previous versions of the rule and the
advisory material as a Failure Condition which would prevent continued safe flight and landing.)
When using qualitative analyses to determine compliance with CS 25.1309(b), the following descriptions of
the probability terms used in CS 25.1309 and this AMC have become commonly accepted as aids to
engineering judgement:
(1) Probable Failure Conditions are those anticipated to occur one or more times during the entire
operational life of each aeroplane.
2-F-7
CS-25 BOOK 2
(2) Remote Failure Conditions are those unlikely to occur to each aeroplane during its total life, but which
may occur several times when considering the total operational life of a number of aeroplanes of the type.
(3) Extremely Remote Failure Conditions are those not anticipated to occur to each aeroplane during its
total life but which may occur a few times when considering the total operational life of all aeroplanes of the
type.
(4) Extremely Improbable Failure Conditions are those so unlikely that they are not anticipated to occur
during the entire operational life of all aeroplanes of one type.
When using quantitative analyses to help determine compliance with CS 25.1309(b), the following
descriptions of the probability terms used in this requirement and this AMC have become commonly accepted
as aids to engineering judgement. They are expressed in terms of acceptable ranges for the Average Probability
Per Flight Hour.
(i) Probable Failure Conditions are those having an Average Probability Per Flight Hour greater than of the
-5
order of 1 x 10 .
-
(ii) Remote Failure Conditions are those having an Average Probability Per Flight Hour of the order of 1x 10
5
or less, but greater than of the order of 1 x 10-7.
(iii) Extremely Remote Failure Conditions are those having an Average Probability Per Flight Hour of the
-7 -9
order of 1x 10 or less, but greater than of the order of 1 x 10 .
(iv) Extremely Improbable Failure Conditions are those having an Average Probability Per Flight Hour of the
order of 1x 10-9 or less.
8. SAFETY OBJECTIVE.
a. The objective of CS 25.1309 is to ensure an acceptable safety level for equipment and systems as
installed on the aeroplane. A logical and acceptable inverse relationship must exist between the Average
Probability per Flight Hour and the severity of Failure Condition effects, as shown in Figure 1, such that:
(4) Hazardous Failure Conditions must be no more frequent than Extremely Remote.
2-F-8
BOOK 2 CS-25
b. The safety objectives associated with Failure Conditions are described in Figure 2.
2-F-9
CS-25 BOOK 2
c. The safety objectives associated with Catastrophic Failure Conditions, may be satisfied by demonstrating
that:
d. Exceptionally, for paragraph 8c(2) above of this AMC, if it is not technologically or economically
practicable to meet the numerical criteria for a Catastrophic Failure Condition, the safety objective may be
met by accomplishing all of the following:
(1) Utilising well proven methods for the design and construction of the system; and
2-F-10
BOOK 2 CS-25
(2) Determining the Average Probability per Flight Hour of each Failure Condition using structured methods,
such as Fault Tree Analysis, Markov Analysis, or Dependency Diagrams; and
(3) Demonstrating that the sum of the Average Probabilities per Flight Hour of all Catastrophic Failure
Conditions caused by systems is of the order of 10-7 or less (See paragraph 6a for background).
This paragraph describes specific means of compliance for CS 25.1309. The applicant should obtain early
concurrence of the certification authority on the choice of an acceptable means of compliance.
(1) Equipment covered by 25.1309(a)(1) must be shown to function properly when installed. The aeroplane
operating and environmental conditions over which proper functioning of the equipment, systems, and
installation is required to be considered includes the full normal operating envelope of the aeroplane as
defined by the Aeroplane Flight Manual together with any modification to that envelope associated with
abnormal or emergency procedures. Other external environmental conditions such as atmospheric
turbulence, HIRF, lightning, and precipitation, which the aeroplane is reasonably expected to encounter,
should also be considered. The severity of the external environmental conditions which should be
considered are limited to those established by certification standards and precedence.
(2) In addition to the external operating and environmental conditions, the effect of the environment within
the aeroplane should be considered. These effects should include vibration and acceleration loads,
variations in fluid pressure and electrical power, fluid or vapour contamination, due either to the normal
environment or accidental leaks or spillage and handling by personnel. Document referenced in paragraph
3b(1) defines a series of standard environmental test conditions and procedures, which may be used to
support compliance. Equipment covered by (CS) Technical Standard Orders containing environmental test
procedures or equipment qualified to other environmental test standards can be used to support compliance.
The conditions under which the installed equipment will be operated should be equal to or less severe than
the environment for which the equipment is qualified.
(3) The required substantiation of the proper functioning of equipment, systems, and installations under the
operating and environmental conditions approved for the aeroplane may be shown by test and/or analysis or
reference to comparable service experience on other aeroplanes. It must be shown that the comparable
service experience is valid for the proposed installation. For the equipment systems and installations
covered by CS 25.1309(a)(1), the compliance demonstration should also confirm that the normal functioning
of such equipment, systems, and installations does not interfere with the proper functioning of other
equipment, systems, or installations covered by CS 25.1309(a)(1).
(4) The equipment, systems, and installations covered by CS 25.1309(a)(2) are typically those associated
with amenities for passengers such as passenger entertainment systems, in-flight telephones, etc., whose
failure or improper functioning in itself should not affect the safety of the aeroplane. Operational and
environmental qualification requirements for those equipment, systems, and installations are reduced to the
tests that are necessary to show that their normal or abnormal functioning does not adversely affect the
proper functioning of the equipment, systems, or installations covered by CS 25.1309(a)(1) and does not
otherwise adversely influence the safety of the aeroplane or its occupants. Examples of adverse influences
are: fire, explosion, exposing passengers to high voltages, etc.
Paragraph 25.1309(b) requires that the aeroplane systems and associated components, considered
separately and in relation to other systems must be designed so that any Catastrophic Failure Condition is
Extremely Improbable and does not result from a single failure. It also requires that any Hazardous
2-F-11
CS-25 BOOK 2
Failure Condition is extremely Remote, and that any Major Failure Condition is Remote. An analysis should
always consider the application of the Fail-Safe design concept described in paragraph 6b, and give special
attention to ensuring the effective use of design techniques that would prevent single failures or other events
from damaging or otherwise adversely affecting more than one redundant system channel or more than one
system performing operationally similar functions.
(1) General. Compliance with the requirements of CS 25.1309(b) should be shown by analysis and, where
necessary, by appropriate ground, flight, or simulator tests. Failure Conditions should be identified and their
effects assessed. The maximum allowable probability of the occurrence of each Failure Condition is
determined from the Failure Condition’s effects, and when assessing the probabilities of Failure Conditions
appropriate analysis considerations should be accounted for. Any analysis must consider:
(i) Possible Failure Conditions and their causes, modes of failure, and damage from sources external to the
system.
(iv) The effect of reasonably anticipated crew errors after the occurrence of a failure or Failure Condition.
(v) The effect of reasonably anticipated errors when performing maintenance actions.
(vi) The crew alerting cues, corrective action required, and the capability of detecting faults.
(vii) The resulting effects on the aeroplane and occupants, considering the stage of flight and operating and
environmental conditions.
(2) Planning. This AMC provides guidance on methods of accomplishing the safety objective. The detailed
methodology needed to achieve this safety objective will depend on many factors, in particular the degree of
systems complexity and integration. For aeroplanes containing many complex or integrated systems, it is
likely that a plan will need to be developed to describe the intended process. This plan should include
consideration of the following aspects:
(ii) Determination of detailed means of compliance, which may include the use of Development Assurance
techniques.
(3) Availability of Industry Standards and Guidance Materials. There are a variety of acceptable techniques
currently being used in industry, which may or may not be reflected in Documents referenced in paragraphs
3b(3) and 3b(4). This AMC is not intended to compel the use of these documents during the definition of the
particular method of satisfying the objectives of this AMC. However, these documents do contain material
and methods of performing the System Safety Assessment. These methods, when correctly applied, are
recognised by the Agency as valid for showing compliance with CS 25.1309(b). In addition, Document
referenced in paragraph 3b(4) contains tutorial information on applying specific engineering methods (e.g.
Markov Analysis, Fault Tree Analysis) that may be utilised in whole or in part.
(4) Acceptable Application of Development Assurance Methods. Paragraph 9b(1)(iii) above requires that
any analysis necessary to show compliance with CS 25.1309(b) must consider the possibility of
requirement, design, and implementation errors. Errors made during the design and development of
systems have traditionally been detected and corrected by exhaustive tests conducted on
the system and its components, by direct inspection, and by other direct verification methods capable of
completely characterising the performance of the system. These direct techniques may still be appropriate
for simple systems which perform a limited number of functions and which are not highly integrated with
2-F-12
BOOK 2 CS-25
other aeroplane systems. For more complex or integrated systems, exhaustive testing may either be
impossible because all of the system states cannot be determined or impractical because of the number of
tests which must be accomplished. For these types of systems, compliance may be shown by the use of
Development Assurance. The level of Development Assurance should be determined by the severity of
potential effects on the aeroplane in case of system malfunctions or loss of functions. Guidelines, which
may be used for providing Development Assurance, are described for systems in Document referenced in
paragraph 3b(3), and for software in Documents referenced in paragraphs 3a(3) and 3b(2). (There is
currently no agreed Development Assurance standard for hardware.) Because these documents were not
developed simultaneously, there are differences in the guidelines and terminology that they contain. A
significant difference is the guidance provided on the use of system architecture for determination of the
appropriate development assurance level for hardware and software. EASA recognises that consideration of
system architecture for this purpose is appropriate. Where apparent differences exist between these
documents on this subject, the guidance contained in Appendix D of Document referenced in paragraph
3b(3) should be followed. If the criteria of Document referenced in paragraph 3b(3) are not satisfied by a
particular development assurance process the development assurance levels may have to be increased
using the guidance of Document referenced in paragraph 3b(2).
(i) Where an analysis identifies some indication to, and/or action by, the flight crew, cabin crew, or
maintenance personnel, the following activities should be accomplished:
1 Verify that any identified indications are actually provided by the system.
3 Verify that any actions required have a reasonable expectation of being accomplished successfully and in
a timely manner.
(ii) These verification activities should be accomplished by consulting with engineers, pilots, flight
attendants, maintenance personnel and human factors specialists as appropriate, taking due consideration
of the consequences if the assumed action is not performed or mis-performed.
(iii) In complex situations, the results of the review by specialists may need to be confirmed by simulator or
flight tests. However, quantitative assessments of the probabilities of crew or maintenance errors are not
currently considered feasible. If the failure indications are considered to be recognisable and the required
actions do not cause an excessive workload, then for the purposes of the analysis, the probability that the
corrective action will be accomplished, can be considered to be one. If the necessary actions cannot be
satisfactorily accomplished, the tasks and/or the systems need to be modified.
CS 25.1309(c) requires that information concerning unsafe system operating conditions must be provided to
the crew to enable them to take appropriate corrective action. Compliance with this requirement is usually
demonstrated by the analysis identified in paragraph 9b(1) above, which also includes consideration of crew
alerting cues, corrective action required, and the capability of detecting faults. CS 25.1309(c) requires that a
warning indication must be provided if immediate corrective action is required. Paragraph 25.1309(c) also
requires that systems and controls, including indications and annunciations, must be designed to minimise
crew errors, which could create additional hazards.
(1) The required information will depend on the degree of urgency for recognition and corrective action by
the crew. It should be in the form of :
(i) a warning, if immediate recognition and corrective or compensatory action by the crew is required;
(ii) a caution if immediate crew awareness is required and subsequent crew action will be required;
2-F-13
CS-25 BOOK 2
(iii) an advisory, if crew awareness is required and subsequent crew action may be required;
CS 25.1322 (and AMC 25.1322) give further requirements (and guidance) on the characteristics of the
information required (visual, aural) based on those different categories.
(2) When failure monitoring and indication are provided by a system, its reliability should be compatible with
the safety objectives associated with the system function for which it provides that indication. For example,
if the effects of having a failure and not annunciating that failure are Catastrophic, the combination of the
failure with the failure of its annunciation must be Extremely Improbable. In addition, unwanted operation
(e.g., nuisance warnings) should be assessed. The failure monitoring and indication should be reliable,
technologically feasible and economically practicable. Reliable failure monitoring and indication should utilise
current state of the art technology to maximise the probability of detecting and indicating genuine failures
while minimising the probability of falsely detecting and indicating non-existent failures. Any indication should
be timely, obvious, clear, and unambiguous.
(3) In the case of aeroplane conditions requiring immediate crew action, a suitable warning indication must
be provided to the crew, if not provided by inherent aeroplane characteristics. In either case, any warning
should be rousing and should occur at a point in a potentially catastrophic sequence where the aeroplane's
capability and the crew's ability still remain sufficient for effective crew action.
(4) Unless they are accepted as normal airmanship, procedures for the crew to follow after the occurrence
of failure warning should be described in the approved Aeroplane Flight Manual (AFM) or AFM revision or
supplement.
(5) Even if operation or performance is unaffected or insignificantly affected at the time of failure,
information to the crew is required if it is considered necessary for the crew to take any action or observe
any precautions. Some examples include reconfiguring a system, being aware of a reduction in safety
margins, changing the flight plan or regime, or making an unscheduled landing to reduce exposure to a more
severe Failure Condition that would result from subsequent failures or operational or environmental
conditions. Information is also required if a failure must be corrected before a subsequent flight. If operation
or performance is unaffected or insignificantly affected, information and alerting indications may be inhibited
during specific phases of flight where corrective action by the crew is considered more hazardous than no
action.
(6) The use of periodic maintenance or flight crew checks to detect significant latent failures when they
occur is undesirable and should not be used in lieu of practical and reliable failure monitoring and
indications. Paragraph 12 provides further guidance on the use of periodic maintenance or flight crew
checks. Comparison with similar, previously approved systems is sometimes helpful.
(7) Particular attention should be given to the placement of switches or other control devices, relative to one
another, so as to minimise the potential for inadvertent incorrect crew action, especially during emergencies
or periods of high workload. Extra protection, such as the use of guarded switches, may sometimes be
needed.
Failure Conditions should be identified by considering the potential effects of failures on the aeroplane and
occupants. These should be considered from two perspectives:
(1) by considering failures of aeroplane level functions - Failure Conditions identified at this level are not
dependent on the way the functions are implemented and the systems' architecture.
2-F-14
BOOK 2 CS-25
(2) by considering failures of functions at the system level - these Failure Conditions are identified through
examination of the way that functions are implemented and the systems' architectures.
It should be noted that a Failure Condition might result from a combination of lower level Failure Conditions.
This requires that the analysis of complex, highly integrated systems, in particular, should be conducted in a
highly methodical and structured manner to ensure that all significant Failure Conditions, which arise from
multiple failures and combinations of lower level Failure Conditions, are properly identified and accounted
for. The relevant combinations of failures and Failure Conditions should be determined by the whole safety
assessment process that encompasses the aeroplane and system level functional hazard assessments and
common cause analyses. The overall effect on the aeroplane of a combination of individual system Failure
Conditions occurring as a result of a common or cascade failure, may be more severe than the individual
system effect. For example, Failure Conditions classified as Minor or Major by themselves may have
Hazardous effects at an aeroplane level, when considered in combination.
(1) Before a detailed safety assessment is proceeded with, a Functional Hazard Assessment (FHA) of the
aeroplane and system functions to determine the need for and scope of subsequent analysis should be
prepared. This assessment may be conducted using service experience, engineering and operational
judgement, and/or a top-down deductive qualitative examination of each function. A Functional Hazard
Assessment is a systematic, comprehensive examination of aeroplane and system functions to identify
potential Minor, Major, Hazardous, and Catastrophic Failure Conditions which may arise, not only as a result
of malfunctions or failure to function, but also as a result of normal responses to unusual or abnormal
external factors. It is concerned with the operational vulnerabilities of systems rather than with a detailed
analysis of the actual implementation.
(2) Each system function should be examined with respect to the other functions performed by the
system, because the loss or malfunction of all functions performed by the system may result in a more
severe failure condition than the loss of a single function. In addition, each system function should be
examined with respect to functions performed by other aeroplane systems, because the loss or
malfunction of different but related functions, provided by separate systems may affect the severity of
Failure Conditions postulated for a particular system.
(3) The Functional Hazard Assessment is an engineering tool, which should be performed early in the
design and updated as necessary. It is used to define the high-level aeroplane or system safety objectives
that must be considered in the proposed system architectures. It should also be used to assist in
determining the development assurance levels for the systems. Many systems may need only a simple
review of the system design by the applicant to determine the hazard classification. A Functional Hazard
Assessment requires experienced engineering judgement and early co-ordination between the applicant and
the certification authority.
(4) Depending on the extent of functions to be examined and the relationship between functions and
systems, different approaches to Functional Hazard Assessment may be taken. Where there is a clear
correlation between functions and systems, and where system, and hence function, interrelationships are
relatively simple, it may be feasible to conduct separate Functional Hazard Assessments for each system,
providing any interface aspects are properly considered and are easily understood. However, where system
and function interrelationships are more complex, a top down approach, from an aeroplane level perspective,
should be taken in planning and conducting Functional Hazard Assessments.
The requirements of CS 25.1309(b) are intended to ensure an orderly and thorough evaluation of the effects
on safety of foreseeable failures or other events, such as errors or external circumstances, separately or in
combination, involving one or more system functions. The interactions of these factors within a system and
among relevant systems should be considered. In assessing the effects of a Failure Condition, factors,
which might alleviate or intensify the direct effects of the initial Failure Condition should be considered.
2-F-15
CS-25 BOOK 2
Some of these factors include consequent or related conditions existing within the aeroplane which may
affect the ability of the crew to deal with direct effects, such as the presence of smoke, acceleration effects,
interruption of communication, interference with cabin pressurisation, etc. When assessing the
consequences of a given Failure Condition, account should be taken of the failure information provided, the
complexity of the crew action, and the relevant crew training. The number of overall Failure Conditions
involving other than instinctive crew actions may influence the flight crew performance that can be expected.
Training recommendations may need to be identified in some cases.
(1) The severity of Failure Conditions should be evaluated according to the following:
(i) Effects on the aeroplane, such as reductions in safety margins, degradation in performance, loss of
capability to conduct certain flight operations, reduction in environmental protection, or potential or
consequential effects on structural integrity.
(ii) Effects on the crewmembers, such as increases above their normal workload that would affect their
ability to cope with adverse operational or environmental conditions or subsequent failures.
(2) For convenience in conducting design assessments, Failure Conditions may be classified according to
the severity of their effects as No Safety Effect, Minor, Major, Hazardous, or Catastrophic. Paragraph 7a
above provides accepted definitions of these terms.
(I) The classification of Failure Conditions does not depend on whether or not a system or function is the
subject of a specific requirement or regulation. Some "required" systems, such as transponders, position
lights, and public address systems, may have the potential for only Minor Failure Conditions. Conversely,
other systems which are not "required", such as auto flight systems, may have the potential for Major,
Hazardous, or Catastrophic Failure Conditions.
(ii) Regardless of the types of assessment used, the classification of Failure Conditions should always be
accomplished with consideration of all relevant factors; e.g., system, crew, performance, operational,
external. Examples of factors include the nature of the failure modes, any effects or limitations on
performance, and any required or likely crew action. It is particularly important to consider factors that would
alleviate or intensify the severity of a Failure Condition. An example of an alleviating factor would be the
continued performance of identical or operationally similar functions by other systems not affected by the
Failure Condition. Examples of intensifying factors would include unrelated conditions that would reduce the
ability of the crew to cope with a Failure Condition, such as weather or other adverse operational or
environmental conditions.
After the Failure Conditions have been identified and the severity of the effects of the Failure Conditions
have been assessed, there is a responsibility to determine how to show compliance with the requirement
and obtain the concurrence of EASA. Design and installation reviews, analyses, flight tests, ground tests,
simulator tests, or other approved means may be used.
(1) The probability that a Failure Condition would occur may be assessed as Probable, Remote, Extremely
Remote, or Extremely Improbable. These terms are defined in paragraph 7. Each Failure Condition should
have a probability that is inversely related to the severity of its effects as described in paragraph 8.
(2) When a system provides protection from events (e.g., cargo compartment fire, gusts), its reliability
should be compatible with the safety objectives necessary for the Failure Condition associated with the
failure of the protection system and the probability of such events. (See paragraph 11g of this AMC and
Appendix 4.)
2-F-16
BOOK 2 CS-25
(3) An assessment to identify and classify Failure Conditions is necessarily qualitative. On the other hand,
an assessment of the probability of a Failure Condition may be either qualitative or quantitative. An analysis
may range from a simple report that interprets test results or compares two similar systems to a detailed
analysis that may or may not include estimated numerical probabilities. The depth and scope of an analysis
depends on the types of functions performed by the system, the severity of Failure Conditions, and whether
or not the system is complex.
(4) Experienced engineering and operational judgement should be applied when determining whether or not
a system is complex. Comparison with similar, previously approved systems is sometimes helpful. All
relevant systems attributes should be considered; however, the complexity of the software and hardware
need not be a dominant factor in the determination of complexity at the system level, e.g., the design may be
very complex, such as a satellite communication system, but its function may be fairly simple.
(1) According to the requirements of CS 25.1309b(1)(ii), a Catastrophic Failure Condition must not result
from the failure of a single component, part, or element of a system. Failure containment should be provided
by the system design to limit the propagation of the effects of any single failure to preclude Catastrophic
Failure Conditions. In addition, there must be no common cause failure, which could affect both the single
component, part, or element, and its failure containment provisions. A single failure includes any set of
failures, which cannot be shown to be independent from each other. Appendix 1 and Document referenced
in paragraph 3b(4) describe types of common cause analyses, which may be conducted, to assure that
independence is maintained. Failure containment techniques available to establish independence may
include partitioning, separation, and isolation.
(2) While single failures must normally be assumed to occur, there are cases where it is obvious that, from a
realistic and practical viewpoint, any knowledgeable, experienced person would unequivocally conclude that
a failure mode simply would not occur, unless it is associated with a wholly unrelated Failure Condition that
would itself be Catastrophic. Once identified and accepted, such cases need not be considered failures in
the context of CS 25.1309. For example, with simply loaded static elements, any failure mode, resulting
from fatigue fracture, can be assumed to be prevented if this element is shown to meet the damage
tolerance requirements of CS 25.571.
c. Common Cause Failure Considerations. An analysis should consider the application of the fail-safe
design concept described in paragraph 6b and give special attention to ensure the effective use of design
and installation techniques that would prevent single failures or other events from damaging or otherwise
adversely affecting more than one redundant system channel, more than one system performing
operationally similar functions, or any system and an associated safeguard. When considering such
common-cause failures or other events, consequential or cascading effects should be taken into account.
Some examples of such potential common cause failures or other events would include rapid release of
energy from concentrated sources such as uncontained failures of rotating parts (other than engines and
propellers) or pressure vessels, pressure differentials, non-catastrophic structural failures, loss of
environmental conditioning, disconnection of more than one subsystem or component by over temperature
protection devices, contamination by fluids, damage from localised fires, loss of power supply or return (e.g.
mechanical damage or deterioration of connections), excessive voltage, physical or environmental
interactions among parts, errors, or events external to the system or to the aeroplane (see Document
referenced in paragraph 3b(4)).
d. Depth of Analysis. The following identifies the depth of analysis expected based on the classification of a
Failure Condition.
(1) No Safety Effect Failure Conditions. A Functional Hazard Assessment, with a design and installation
appraisal, to establish independence from other functions is necessary for the safety assessment of these
Failure Conditions. If it is chosen not to do an FHA, the safety effects may be derived from the design and
installation appraisal.
2-F-17
CS-25 BOOK 2
(2) Minor Failure Conditions. A Functional Hazard Assessment, with a design and installation appraisal, to
establish independence from other functions is necessary for the safety assessment of these Failure
Conditions. Combinations of Failure Condition effects, as noted in paragraph 10 above, must also be
considered. If it is chosen not to do an FHA, the safety effects may be derived from the design and
installation appraisal.
(i) If the system is similar in its relevant attributes to those used in other aeroplanes and the effects of
failure would be the same, then design and installation appraisals (as described in Appendix 1), and
satisfactory service history of the equipment being analysed, or of similar design, will usually be acceptable
for showing compliance.
(ii) For systems that are not complex, where similarity cannot be used as the basis for compliance, then
compliance may be shown by means of a qualitative assessment which shows that the system level Major
Failure Conditions, of the system as installed, are consistent with the FHA and are Remote, e.g., redundant
systems.
(iii) For complex systems without redundancy, compliance may be shown as in paragraph 11d(3)(ii) of this
AMC. To show that malfunctions are indeed Remote in systems of high complexity without redundancy (for
example, a system with a self-monitoring microprocessor), it is sometimes necessary to conduct a qualitative
functional Failure Modes and Effects Analysis (FMEA) supported by failure rate data and fault detection
coverage analysis.
(iv) An analysis of a redundant system is usually complete if it shows isolation between redundant system
channels and satisfactory reliability for each channel. For complex systems where functional redundancy is
required, a qualitative FMEA and qualitative fault tree analysis may be necessary to determine that
redundancy actually exists (e.g. no single failure affects all functional channels).
(4) Hazardous and Catastrophic Failure Conditions. Hazardous Failure Conditions must be Extremely
Remote, and Catastrophic Failure Conditions must be Extremely Improbable:
(i) Except as specified in paragraph 11d(4)(ii) below a detailed safety analysis will be necessary for each
Hazardous and Catastrophic Failure Condition identified by the functional hazard assessment. The analysis
will usually be a combination of qualitative and quantitative assessment of the design.
(ii) For very simple and conventional installations, i.e. low complexity and similarity in relevant
attributes, it may be possible to assess a Hazardous or Catastrophic Failure Condition as being Extremely
Remote or Extremely Improbable, respectively, on the basis of experienced engineering judgement, using
only qualitative analysis. The basis for the assessment will be the degree of redundancy, the established
independence and isolation of the channels and the reliability record of the technology involved. Satisfactory
service experience on similar systems commonly used in many aeroplanes may be sufficient when a close
similarity is established in respect of both the system design and operating conditions.
(iii) For complex systems where true similarity in all relevant attributes, including installation attributes,
can be rigorously established, it may be also possible to assess a Hazardous or Catastrophic Failure
Condition as being Extremely Remote or Extremely Improbable, respectively, on the basis of experienced
engineering judgement, using only qualitative analysis. A high degree of similarity in both design and
application is required to be substantiated.
(1) The Average Probability per Flight Hour is the probability of occurrence, normalised by the flight time, of a
Failure Condition during a flight, which can be seen as an average over all possible flights of the fleet of
aeroplane to be certified. The calculation of the Average Probability per Flight Hour for a Failure Condition
should consider:
2-F-18
BOOK 2 CS-25
(i) the average flight duration and the average flight profile for the aeroplane type to be certified,
(ii) all combinations of failures and events that contribute to the Failure Condition,
(iii) the conditional probability if a sequence of events is necessary to produce the Failure Condition,
(iv) the relevant "at risk" time if an event is only relevant during certain flight phases,
(v) the average exposure time if the failure can persist for multiple flights.
(2) The details how to calculate the Average Probability per Flight Hour for a Failure Condition are given in
Appendix 3 of this AMC.
(3) If the probability of a subject Failure Condition occurring during a typical flight of mean duration for the
aeroplane type divided by the flight’s mean duration in hours is likely to be significantly different from the
predicted average rate of occurrence of that Failure Condition during the entire operational life of all
aeroplanes of that type, then a risk model that better reflects the Failure Condition should be used.
(4) It is recognised that, for various reasons, component failure rate data are not precise enough to enable
accurate estimates of the probabilities of Failure Conditions. This results in some degree of uncertainty, as
indicated by the wide line in Figure 1, and the expression "on the order of" in the descriptions of the
quantitative probability terms that are provided above. When calculating the estimated probability of each
Failure Condition, this uncertainty should be accounted for in a way that does not compromise safety.
f. Integrated Systems. Interconnections between systems have been a feature of aeroplane design for
many years and CS 25.1309(b) recognises this in requiring systems to be considered in relation to other
systems. Providing the interfaces between systems are relatively few and simple, and hence readily
understandable, compliance may often be shown through a series of system safety assessments, each of
which deals with a particular Failure Condition (or more likely a group of Failure Conditions) associated with
a system and, where necessary, takes account of failures arising at the interface with other systems. This
procedure has been found to be acceptable in many past certification programs. However, where the
systems and their interfaces become more complex and extensive, the task of demonstrating compliance
may become more complex. It is therefore essential that the means of compliance are considered early in
the design phase to ensure that the design can be supported by a viable safety assessment strategy.
Aspects of the guidance material covered elsewhere in this AMC and which should be given particular
consideration are as follows:
(2) considering the importance of architectural design in limiting the impact and propagation of failures,
(3) the potential for common cause failures and cascade effects and the possible need to assess
combinations of multiple lower level (e.g. Major) Failure Conditions,
(4) the importance of multi-disciplinary teams in identifying and classifying significant Failure Conditions,
(5) effect of crew and maintenance procedures in limiting the impact and propagation of failures.
In addition, rigorous and well-structured design and development procedures play an essential role in
facilitating a methodical safety assessment process and providing visibility to the means of compliance.
Document referenced in paragraph 3b(3) may be helpful in the certification of highly integrated or complex
aircraft systems.
g. Operational or Environmental Conditions. A probability of one should usually be used for encountering a
discrete condition for which the aeroplane is designed, such as instrument meteorological conditions or
Category III weather operations. However, Appendix 4 contains allowable probabilities, which may be
assigned to various operational and environmental conditions for use in computing the average probability
2-F-19
CS-25 BOOK 2
per flight hour of Failure Conditions resulting from multiple independent failures, without further justification.
Appendix 4 is provided for guidance and is not intended to be exhaustive or prescriptive. At this time, a
number of items have no accepted standard statistical data from which to derive a probability figure.
However, these items are included for either future consideration or as items for which the applicant may
propose a probability figure supported by statistically valid data or supporting service experience. The
applicant may propose additional conditions or different probabilities from those in Appendix 4 provided they
are based on statistically valid data or supporting service experience. The applicant should obtain early
concurrence of the Agency when such conditions are to be included in an analysis. When combining the
probability of such a random condition with that of a system failure, care should be taken to ensure that the
condition and the system failure are independent of one another, or that any dependencies are properly
accounted for.
(1) Any analysis is only as accurate as the assumptions, data, and analytical techniques it uses. Therefore,
to show compliance with the requirements, the underlying assumptions, data, and analytic techniques should
be identified and justified to assure that the conclusions of the analysis are valid. Variability may be inherent
in elements such as failure modes, failure effects, failure rates, failure probability distribution functions,
failure exposure times, failure detection methods, fault independence, limitation of analytical methods,
processes, and assumptions. The justification of the assumptions made with respect to the above items
should be an integral part of the analysis. Assumptions can be validated by using experience with identical
or similar systems or components with due allowance made for differences of design, duty cycle and
environment. Where it is not possible to fully justify the adequacy of the safety analysis and where data or
assumptions are critical to the acceptability of the Failure Condition, extra conservatism should be built into
either the analysis or the design. Alternatively any uncertainty in the data and assumptions should be
evaluated to the degree necessary to demonstrate that the analysis conclusions are insensitive to that
uncertainty.
(2) Where adequate validation data is not available (e.g., new or novel systems), and extra conservatism is
built into the analysis, then the normal post-certification in-service follow-up may be performed to obtain the
data necessary to alleviate any consequence of the extra conservatism. This data may be used, for
example, to extend system check intervals.
This AMC addresses only those operational and maintenance considerations that are directly related to
compliance with CS 25.1309; other operational and maintenance considerations are not discussed herein.
Flight crew and maintenance tasks related to compliance with this requirement should be appropriate and
reasonable. However, quantitative assessments of crew errors are not considered feasible. Therefore,
reasonable tasks are those for which full credit can be taken because they can realistically be anticipated to
be performed correctly when they are required or scheduled. In addition, based on experienced engineering
and operational judgement, the discovery of obvious failures during normal operation or maintenance of the
aeroplane may be assumed, even though identification of such failures is not the primary purpose of the
operational or maintenance actions.
When assessing the ability of the flight crew to cope with a Failure Condition, the information provided to the
crew and the complexity of the required action should be considered. If the evaluation indicates that a
potential Failure Condition can be alleviated or overcome without jeopardising other safety related flight crew
tasks and without requiring exceptional pilot skill or strength, credit may be taken for both qualitative and
quantitative assessments. Similarly, credit may be taken for correct flight crew performance of the periodic
checks required to demonstrate compliance with CS 25.1309(b) provided overall flight crew workload during
the time available to perform them is not excessive and they do not require exceptional pilot skill or strength.
Unless flight crew actions are accepted as normal airmanship, they should be described in the approved
Aeroplane Flight Manual.
2-F-20
BOOK 2 CS-25
b. Maintenance Action.
Credit may be taken for correct accomplishment of reasonable maintenance tasks, for both qualitative and
quantitative assessments. The maintenance tasks needed to show compliance with CS 25.1309(b) should
be established. In doing this, the following maintenance scenarios can be used:
(1) Annunciated failures will be corrected before the next flight, or a maximum time period will be established
before a maintenance action is required. If the latter is acceptable, the analysis should establish the
maximum allowable interval before the maintenance action is required. These maximum allowable intervals
should be reflected in either the MMEL or the type certificate.
(2) Latent failures will be identified by a scheduled maintenance task. If this approach is taken, and the
Failure Condition is Hazardous or Catastrophic, then a CCMR maintenance task should be established.
Some Latent Failures can be assumed to be identified based upon return to service test on the LRU
following its removal and repair (component Mean Time Between Failures (MTBF) should be the basis for
the check interval time).
(1) By detecting the presence of, and thereby limiting the exposure time to significant latent failures that
would, in combination with one or more other specific failures or events identified by safety analysis, result in
a Hazardous or Catastrophic Failure Condition, periodic maintenance or flight crew checks may be used to
help show compliance with CS 25.1309(b). Where such checks cannot be accepted as basic servicing or
airmanship they become CCMRs. AMC 25.19 details the handling of CCMRs.
(2) Rational methods, which usually involve quantitative analysis, or relevant service experience should be
used to determine check intervals. This analysis contains inherent uncertainties as discussed in paragraph
11e(3). Where periodic checks become CMRs these uncertainties justify the controlled escalation or
exceptional short-term extensions to individual CMRs allowed under AMC 25.19.
A list may be developed of equipment and functions which need not be operative for flight, based on stated
compensating precautions that should be taken, e.g., operational or time limitations, flight crew procedures,
or ground crew checks. The documents used to show compliance with CS 25.1309, together with any other
relevant information, should be considered in the development of this list, which then becomes the basis for
a Master Minimum Equipment List (MMEL). Experienced engineering and operational judgement should be
applied during the development of the MMEL.
The means to assure continuing compliance with CS 25.1309 for modifications to previously certificated
aeroplanes should be determined on a case-by-case basis and will depend on the applicable aeroplane
certification basis and the extent of the change being considered. The change could be a simple
modification affecting only one system or a major redesign of many systems, possibly incorporating new
technologies. The minimal effort for demonstrating compliance to 25.1309 for any modification is an
assessment of the impact on the original system safety assessment. The result of this assessment may
range from a simple statement that the existing system safety assessment still applies to the modified
system in accordance with the original means of compliance, to the need for new means of compliance
encompassing the plan referred to in paragraph 9b. (STC applicants, if the TC holder is unwilling to release
or transfer proprietary data in this regard, the STC applicant may have to create the System Safety
Assessment. Further guidance may be found in paragraph 11 of Document referenced in paragraph 3b(3).)
It is recommended that the Agency be contacted early to obtain agreement on the means of compliance.
2-F-21
CS-25 BOOK 2
Various methods for assessing the causes, severity, and probability of Failure Conditions are available to
support experienced engineering and operational judgement. Some of these methods are structured. The
various types of analysis are based on either inductive or deductive approaches. Probability assessments
may be qualitative or quantitative. Descriptions of some types of analysis are provided below and in
Document referenced in paragraph 3b(4).
a. Design Appraisal. This is a qualitative appraisal of the integrity and safety of the system design.
b. Installation Appraisal. This is a qualitative appraisal of the integrity and safety of the installation. Any
deviations from normal, industry accepted installation practices, such as clearances or tolerances, should be
evaluated, especially when appraising modifications made after entry into service.
c. Failure Modes and Effects Analysis. This is a structured, inductive, bottom-up analysis, which is used to
evaluate the effects on the system and the aeroplane of each possible element or component failure. When
properly formatted, it will aid in identifying latent failures and the possible causes of each failure mode.
Document referenced in paragraph 3b(4) provides methodology and detailed guidelines, which may be used
to perform this type of analysis. A FMEA could be apiece part FMEA or a functional FMEA. For modern
microcircuit based LRUs and systems an exhaustive piece part FMEA is not practically feasible with the
present state of the art. In that context, a FMEA may be more functional than piece part oriented. A
functional oriented FMEA can lead to uncertainties in the qualitative and quantitative aspects, which can be
compensated for by more conservative assessment such as:
-- taking into account the experience lessons learned on the use of similar technology.
d. Fault Tree or Dependence Diagram Analysis. Structured, deductive, top-down analyses that are used to
identify the conditions, failures, and events that would cause each defined Failure Condition. They are
graphical methods of identifying the logical relationship between each particular Failure Condition and the
primary element or component failures, other events, or combinations thereof that can cause it. A failure
modes and effects analysis may be used as the source document for those primary failures or other events.
e. Markov Analysis. A Markov model (chain) represents various system states and the relationships among
them. The states can be either operational or non-operational. The transitions from one state to another are
a function of the failure and repair rates. Markov analysis can be used as a replacement for fault
tree/dependence diagram analysis, but it often leads to more complex representation, especially when the
system has many states. It is recommended that Markov analysis be used when fault tree or dependence
diagrams are not easily usable, namely to take into account complex transition states of systems which are
difficult to represent and handle with classical fault tree or dependence diagram analysis.
f. Common Cause Analysis. The acceptance of adequate probability of Failure Conditions is often derived
from the assessment of multiple systems based on the assumption that failures are independent. Therefore,
it is necessary to recognise that such independence may not exist in the practical sense and specific studies
are necessary to ensure that independence can either be assured or deemed acceptable.
(1) Zonal Safety Analysis. This analysis has the objective of ensuring that the equipment installations within
each zone of the aeroplane are at an adequate safety standard with respect to design and installation
standards, interference between systems, and maintenance errors. In those areas of the aeroplane where
multiple systems and components are installed in close proximity, it should be ensured that the zonal
analysis would identify any failure or malfunction which by itself is considered sustainable but which could
have more serious effects when adversely affecting other adjacent systems or components.
2-F-22
BOOK 2 CS-25
(2) Particular Risk Analysis. Particular risks are defined as those events or influences, which are outside
the systems concerned. Examples are fire, leaking fluids, bird strike, tire burst, high intensity radiated fields
exposure, lightning, uncontained failure of high energy rotating machines, etc. Each risk should be the
subject of a specific study to examine and document the simultaneous or cascading effects or influences,
which may violate independence.
(3) Common Mode Analysis. This analysis is performed to confirm the assumed independence of the
events, which were considered in combination for a given Failure Condition. The effects of specification,
design, implementation, installation, maintenance, and manufacturing errors, environmental factors other
than those already considered in the particular risk analysis, and failures of system components should be
considered.
g. Safety Assessment Process. Appendix 2 provides an overview of the Safety Assessment Process.
In showing compliance with 25.1309(b), the considerations covered in this AMC should be addressed in a
methodical and systematic manner, which ensures that the process and its findings are visible and readily
assimilated. This appendix is provided primarily for those who are not familiar with the various methods and
procedures generally used in the industry to conduct safety assessments. This guide and Figures A2-1 and
A2-2 are not certification checklists, and they do not include all the information provided in this AMC. There
is no necessity for them to be used or for the Agency to accept them, in whole or in part, to show compliance
with any regulation. Their sole purposes are to assist, by illustrating a systematic approach to safety
assessments, to enhance understanding and communication by summarising some of the information
provided in this AMC, and to provide some suggestions on documentation. More detailed guidance can be
found in Document referenced in paragraph 3b(4). Document referenced in paragraph 3b(3) includes
additional guidance on how the safety assessment process relates to the system development process.
a. Define the system and its interfaces, and identify the functions that the system is to perform.
Determine whether or not the system is complex, similar to systems used on other aeroplanes, or
conventional. Where multiple systems and functions are to be evaluated, consider the relationships between
multiple safety assessments.
b. Identify and classify Failure Conditions. All relevant engineering organisations, such as systems,
structures, propulsion, and flight test, should be involved in this process. This identification and
classification may be done by conducting a Functional Hazard Assessment, which is usually based on one of
the following methods, as appropriate:
(1) If the system is not complex and its relevant attributes are similar to those of systems used on other
aeroplanes, the identification and classification may be derived from design and installation appraisals and
the service experience of the comparable, previously approved systems.
(2) If the system is complex, it is necessary to systematically postulate the effects on the safety of the
aeroplane and its occupants resulting from any possible failures, considered both individually and in
combination with other failures or events.
c. Choose the means to be used to determine compliance with CS 25.1309. The depth and scope of
the analysis depends on the types of functions performed by the system, the severity of system Failure
Conditions, and whether or not the system is complex (see Figure A2-2). For Major Failure Conditions,
experienced engineering and operational judgement, design and installation appraisals and comparative
service experience data on similar systems may be acceptable, either on their own or in conjunction with
qualitative analyses or selectively used quantitative analyses. For Hazardous or Catastrophic Failure
Conditions, a very thorough safety assessment is necessary. The early concurrence of the Agency on the
choice of an acceptable means of compliance should be obtained.
2-F-23
CS-25 BOOK 2
d. Conduct the analysis and produce the data, which are agreed with the certification authority as
being acceptable to show compliance. A typical analysis should include the following information to the
extent necessary to show compliance:
(2) A list of the parts and equipment of which the system is comprised, including their performance
specifications or design standards and development assurance levels if applicable. This list may reference
other documents, e.g., Certification Specification-Technical Standard Orders (CS-TSOs), manufacturers or
military specifications, etc.
(3) The conclusions, including a statement of the Failure Conditions and their classifications and
probabilities (expressed qualitatively or quantitatively, as appropriate) that show compliance with the
requirements of CS 25.1309.
(4) A description that establishes correctness and completeness and traces the work leading to
the conclusions. This description should include the basis for the classification of each Failure
Condition (e.g., analysis or ground, flight, or simulator tests). It should also include a description of
precautions taken against common-cause failures, provide any data such as component failure rates
and their sources and applicability, support any assumptions made, and identify any required flight
crew or ground crew actions, including any CCMRs.
e. Assess the analyses and conclusions of multiple safety assessments to ensure compliance with the
requirements for all aeroplane level Failure Conditions.
2-F-24
BOOK 2 CS-25
Compliance Statements
25.1309(b) and (c) Maintenance Requirements
Flight Manual Requirements
System Safety
System FHA’s Assessments
Analyses
2-F-25
CS-25 BOOK 2
Conduct Functional
Hazard Assessment Note: FHA may be based
(10b) on a design and
installation appraisal for
these systems.
Is there a NO
safety effect?
YES
NO
NO
NO
Conduct qualitative
NO Is the system YES
assessment (11d(3)(ii) or
redundant?
11d(3)(iv))
NO
NO
2-F-26
BOOK 2 CS-25
The purpose of this material is to provide guidance for calculating the "Average Probability per Flight Hour"
for a Failure Condition so that it can be compared with the quantitative criteria of the AMC.
The process of calculating the "Average Probability per Flight Hour" for a Failure Condition will be described
as a four-step process and is based on the assumption that the life of an aeroplane is a sequence of
"Average Flights".
Step 2: Calculation of the probability of a Failure Condition for a certain "Average Flight"
Step 4: Calculation of the "Average Probability Per Flight Hour" of a Failure Condition
a. Determination of the "Average Flight”. The "Average Probability per Flight Hour" is to be based on an
"Average Flight". The average flight duration and average flight profile for the fleet of aeroplane to be
certified should be estimated. The average flight duration should be estimated based on expectations and
historical experience for similar types. The "Average Flight" duration should reflect the best estimate of the
cumulative flight hours divided by the cumulative aeroplane flights for the service life of the aeroplane. The
"Average Flight" profile should be based on the operating weight and performance expectations for the
average aeroplane when flying a flight of average duration in an ICAO standard atmosphere. The duration
of each flight phase (e.g. takeoff, climb, cruise, descent, approach and landing) in the "Average Flight"
should be based on the average flight profile. Average taxi times for departure and arrival at an average
airport should be considered where appropriate and added to the average flight time. The "Average Flight"
duration and profile should be used as the basis for determining the "Average Probability per Flight Hour" for
a quantitative safety assessment.
b. Calculation of the Probability of a Failure Condition for a certain "Average Flight" . The probability of a
Failure Condition occurring on an "Average Flight" PFlight(Failure Condition) should be determined by
structured methods (see Document referenced in paragraph 3b(4) for example methods) and should
consider all significant elements (e.g. combinations of failures and events) that contribute to the Failure
Condition. The following should be considered:
(1) The individual part, component, and assembly failure rates utilised in calculating the "Average
Probability per Flight Hour" should be estimates of the mature constant failure rates after infant mortality and
prior to wear-out and should be based on all causes of failure (operational, environmental, etc.). Where
available, service history of same or similar components in the same or similar environment should be used.
(2) If the failure is only relevant during certain flight phases, the calculation should be based on the
probability of failure during the relevant "at risk" time for the "Average Flight".
(3) If one or more failed elements in the system can persist for multiple flights (latent, dormant, or hidden
failures), the calculation should consider the relevant exposure times (e.g. time intervals between
maintenance and operational checks/ inspections). In such cases the probability of the Failure Condition
increases with the number of flights during the latency period.
(4) If the failure rate of one element varies during different flight phases, the calculation should consider the
failure rate and related time increments in such a manner as to establish the probability of the Failure
Condition occurring on an "Average Flight":
It is assumed that the "Average Flight" can be divided into n phases (phase 1, ... , phase n). Let TF the
"Average Flight" duration, T j the duration of phase j and tj the transition point between Tj and Tj+1, j=1, ... ,n .
I.e.
2-F-27
CS-25 BOOK 2
n
TF = ∑j=1
T j and t j - t j-1 = T j ; j = 1, ... , n
Let lj(t) the failure rate function during phase j, i.e. for t Î [tj-1,tj].
Remark: lj(t) may be equal 0 for all t Î [tj-1,tj] for a specific phase j.
Let PFlight (Failure) the probability that the element fails during one certain flight (including non-
flying time) and PPhase j (Failure) the probability that the element fails in phase j.
(i) The element is checked operative at the beginning of the certain flight. Then
( [ ])
n n
PFlight (Failure) = ∑j=1
PPhase j (Failure) = ∑j=1
P Failure t ∈ t j−1 , t j
n ti
= 1 − ∏ exp − ∫ λi ( x ) d x
i=1 t i-1
(ii) The state of the item is unknown at the beginning of the certain flight. Then
where Pprior (Failure) is the probability that the failure of the element has occurred prior to
the certain flight.
(5) If there is only an effect when failures occur in a certain order, the calculation should account for the
conditional probability that the failures occur in the sequence necessary to produce the Failure Condition.
c. Calculation of the Average Probability per Flight of a Failure Condition. The next step is to calculate the
"Average Probability per Flight" for the Failure Condition. I.e. the probability of the Failure Condition for each
flight (which might be different although all flights are "Average Flights") during the relevant time (e.g. the
least common multiple of the exposure times or the aeroplane life) should be calculated, summed up and
divided by the number of flights during that period. The principles of calculating are described below and
also in more detail in Document referenced in paragraph 3b(4).
N
2-F-28
BOOK 2 CS-25
d. Calculation of the Average Probability per Flight Hour of a Failure Condition. Once the "Average
Probability per Flight" has been calculated it should be normalised by dividing it by the "Average Flight"
duration TF in Flight Hours to obtain the "Average Probability per Flight Hour". This quantitative value should
be used in conjunction with the hazard category/effect established by the FHA to determine if it is compliant
for the Failure Condition being analysed.
The following probabilities may be used for environmental conditions and operational factors in quantitative
safety analyses:
Environmental Factors
Aeroplane Configurations
2-F-29
CS-25 BOOK 2
Flight Conditions
-2
Flight condition requiring Stall Warning Assumption 10 per flight
Flight condition resulting in a Stall Assumption 10-5 per flight
Excessiveness of VMO/MMO Assumption 10-2 per flight
Flight condition greater than or equal to 1.5 g No accepted standard
data
Flight condition less than or equal to 0 g No accepted standard
data
Mission Dependencies
Other Events
Notes:
1. If “No accepted standard data” appears in the above tables, the applicant must provide a justified
value if a probability less than 1 is to be used in the analysis.
2. The probabilities quoted in this Appendix have been found to be appropriate for use in the context
of a quantitative safety analysis performed to demonstrate compliance with CS 25.1309. They may not
always be appropriate for use in the context of other requirements.
2-F-30
BOOK 2 CS-25
AMC 25.1310(a)
Power Source Capacity and Distribution
When alternative or multiplication of systems and equipment is provided to meet the requirements of CS
25.1310(a), the segregation between circuits should be such as to minimise the risk of a single occurrence
causing multiple failures of circuits or power supplies of the system concerned. For example, electrical cable
bundles or groups of hydraulic pipes should be so segregated as to prevent damage to the main and
alternative systems and power supplies.
AMC 25.1315
Negative Accelerations
1 Demonstration of compliance with CS 25.1315 should be made by analysis and/or ground tests, and
should be supported by flight tests.
2 Analysis and/or Ground Tests. Appropriate analysis and/or ground tests should be made on
components of essential fluid systems and such other components as are likely to be adversely affected by
negative acceleration to demonstrate that they will not produce a hazardous malfunction.
3 Flight Tests
3.2 The tests should be made at the most critical condition from the fuel flow standpoint, e.g. with fuel
flow corresponding to maximum continuous power and with the fuel representing a typical operational low
fuel condition as for a missed approach.
AMC 25.1322
Alerting Systems
1 INTRODUCTION
This AMC gives general guidance on the design and certification of alerting systems. The term “alerting
system” is meant to include all the Warnings, Cautions and Advisories (see paragraph 3 below) on the flight
deck whether they are provided by a single system or not. It includes both the means used to draw the
attention of the crew to the existence of an abnormality or an aircraft condition and the means of identifying
it. In any case where the guidance appears to conflict with a specific CS–25 requirement the requirement
must take priority.
2-F-31
CS-25 BOOK 2
2 ARP 4102/4 Flight Deck Alerting System (FAS) Society of Automotive Engineers. July 1988.
4 CAA Paper “Guidelines for Auditory Warnings Systems on Civil Aircraft.” November 1982
82017
3 DEFINITIONS
In this AMC, where the following terms are used, they have the following meanings:
Alert: A signal to the crew intended to draw their attention to the existence of an abnormality, system fault or
aircraft condition and to identify it.
Nuisance Alert: An unwanted alert not caused by an alerting system failure but by any other cause.
Warning: Immediate recognition and corrective or compensatory action by the crew is required.
Caution: Immediate crew awareness is required and subsequent crew action will be required.
Advisory: Crew awareness is required and subsequent crew action may be required.
Message: A caption light or text on a display system providing information on an abnormality or aircraft
condition.
4.1 The crew should be alerted to the presence of a Warning or Caution message by an attention-
getting device. This may be achieved by any of the following:
4.1.1 Flashing red light for Warnings and flashing amber light for Cautions.
4.1.2 An aural signal coded to distinguish between a Warning and a Caution accompanied by steady or
flashing red or amber lights (see 4.1.1).
2-F-32
BOOK 2 CS-25
4.2 The lights referred to in 4.1 above should be placed where they are in the normal field of view of
each crew member (e.g. on or immediately below the glare shield) and visible in all lighting conditions but
without being blinding. Manual dimming should not be provided unless the minimum setting retains
adequate attention-getting qualities when flying from night into day conditions or an aural alert is also
provided. Automatic dimming may be provided if an aural alert is also provided.
4.3 If aural signals are provided, the signal for a Warning should always take priority over that for a
Caution. Voice alerts should be heard in order of priority.
4.4 It should be possible for the crew to extinguish an alerting light and silence an aural alert, preferably
by pressing the light, unless CS requires otherwise.
TABLE 1
AURAL VISUAL
Warning Immediate recognition and Optional unless required Red Visual alert
corrective or compensatory action by CS should
by the crew is required flash if no
aural
Caution Immediate crew awareness is Optional unless required Amber Visual alert
required and subsequent crew by CS should
action will be required flash if no
aural
Note: Some sub-division of Caution and/or Advisory alert categories is permitted if justified.
5 VISUAL SIGNALS
5.1 Warning and Caution messages should be grouped on a panel or display visible to all members of
the minimum flight crew. Where it is not possible to find a single location visible to all crewmembers,
duplicate panels or displays should be added. If space constraints make it necessary to split the panel into
two parts located in different places, both parts should be visible to all members of the minimum flight crew
and the alerting lights referred to in paragraph 4.1 should direct the attention of the crew to the appropriate
part.
5.2 Warning messages as required by CS 25.1322 should be red and Caution messages should be
amber. Advisories may be any colour except red, and preferably not amber.
5.3 The design of the aeroplane and its systems should be such as to minimise the number of warnings
necessary.
5.4 Captions on the panel or messages on the display should be unambiguous and easily readable, i.e.
they should identify the fault or abnormality clearly enough to direct the crew to the correct procedure.
2-F-33
CS-25 BOOK 2
Where the caption or message does not identify the nature and location of the fault sufficiently precisely to
ensure the correct remedial action, additional indications should be located close to, or preferably on the
appropriate switches or controls to direct the crew to them. In particular, engine fire warnings should be
repeated on or near the controls for the appropriate engine so as to minimise the risk of shutting down the
wrong engine.
5.5 Caution and Advisory messages on the panel or display may be suppressed by the crew provided
that there remains an indication that an abnormality still exists and the message can be recalled to the
display by the crew.
5.6 If a failure causes the display of a number of related messages (e.g. an engine failure resulting in
loss of hydraulic and electrical systems) the messages, where practicable, should be shown (e.g. on a CRT)
in the order in which crew action is required.
Where the display is unable to show all the resulting messages an indication should be given that messages
additional to those shown exist and it must be possible for the crew to have those additional messages
shown.
6.1 The number of different aural signals on the flight deck, including those for Warnings, Cautions,
altitude alert, marker beacons etc., should be minimised and it is strongly recommended that the total should
not exceed eight. (Marker beacon signals may be counted as a single system.)
6.2 Dedicated aural signals should be provided only where specified by airworthiness or operational
requirements and where normal aural alerts (reference paragraph 4.1.2) cannot meet these requirements.
6.3 It is strongly recommended that aural signals are supplied both to headsets and a flight deck
loudspeaker, so that the signals are audible to the crew whether they are wearing headsets (taking into
account their noise attenuation characteristics) or not.
6.4 The loudness of aural signals should be set so as to ensure that they would be heard under all
foreseeable operating conditions. The minimum volume achievable by any manual adjustment (if provided)
of aural signals should be adequate to ensure an alert if the level of flight deck noise subsequently
increases. It is recommended that automatic volume control is provided to compensate for changing
ambient noise.
6.5 Both the pitch and the temporal pattern of aural signals should be varied to make them distinctive
from one another.
6.6 Some aural signals are not permitted by the requirements to be silenced except by a return to
normal conditions, e.g. over speed and take-off configuration and, in some conditions, landing gear warning.
6.7 There should be only one aural signal at a time. If the possibility of two or more aural signals at the
same time cannot be avoided it should be shown that each signal is clearly intelligible to the crew. The
order in which the signals are presented should be that in which crew action is required.
7 GENERAL
7.1 Warnings, Cautions and Advisories, that require no crew action in a particular phase of flight, may
be inhibited if it is safer to do so. Substantiation should be provided on request. However, if it occurs before
entering a flight phase when it would be inhibited, the inhibition should not operate on that message.
Inhibited messages should be revealed in order of priority at the end of the inhibition phase.
2-F-34
BOOK 2 CS-25
7.2 The crew should be able to isolate the attention-getting device in the event of a fault in the alerting
system so as to avoid continuous unwanted operation. Rearming of the alerting system before the next flight
may be accomplished either –
7.2.1 Automatically, or
7.3 There should be no significant delay in an alert after the attainment of a Warning or Caution
threshold unless the level of urgency and the flight phase permits it.
For establishing compliance of the alerting system with CS 25.1309, both the failure to operate when
required and unwanted operation should be considered –
8.1 The reliability of the alerting system should be compatible with the Safety Objectives associated
with the system function for which it provides an alert. Crew alerting of certain parameters may be an
Essential function. Where this is so, loss of crew alerting should be Improbable.
8.2 The alerting system should be designed to avoid false and nuisance alerts. The possible effects of
a false alert should be assessed for each function and taken into account in establishing the required Safety
Objectives. In addition, the occurrence rate of false and nuisance alerts should be low enough to maintain
crew confidence in the alerting system.
8.3 In demonstrating compliance with paragraph 8.1 it would also be necessary to show that –
a. No probable single failure can cause the total loss of either the Warning or the Caution attention-
getting means defined in 4.1.
b. If a single failure can cause the loss of the central warning and caution panel or display, adequate
secondary means of identification is provided, where necessary.
c. A single failure, which could cause the loss, or failure of a system function does not also result in
the loss of any associated alerting function unless the consequences are minor.
8.4 The alerting functions associated with those systems, which may be essential for continued safe
flight, and landing should be available when the aircraft is operating without normal electrical power.
8.5 It should be possible to test the system to the extent necessary to comply with CS 25.1309. It
should also be possible for the crew to check all alerting system indication filaments or other display devices.
AMC 25.1323(d)
Airspeed Indicating System
An acceptable means of compliance when demonstrating a perceptible speed change between 1.23
VSR to stall warning speed is for the rate of change of IAS with CAS to be not less than 0.75."
AMC 25.1323(e)
Airspeed Indicating System
An acceptable means of compliance when demonstrating a perceptible speed change between VMO to
VMO + 2/3 (VDF - VMO) is for the rate of change of IAS with CAS to be not less than 0.50."
2-F-35
CS-25 BOOK 2
AMC 25.1323(h)
Airspeed Indicating System
The design and installation of the pitot system should be such that positive drainage of moisture is provided,
chafing of the tubing and excessive distortion at bends is avoided, and the lag and the possibility of moisture
blockage in the tubing should be kept to an acceptable minimum.
1 Tests should be conducted to the same standard as recommended for turbine engine air intakes
(see AMC 25.1093(b)(1)) unless it can be shown that the items are so designed and located as not to be
susceptible to icing conditions. Ice crystal and mixed ice and water cloud will need to be considered where
the system is likely to be susceptible to such conditions.
2 However, in conducting these tests due regard should be given to the presence of the aeroplane
and its effect on the local concentration of the cloud.
AMC 25.1327
Direction Indicator
This AMC addresses the accuracy of stabilised magnetic heading systems, required for safe operation of the
aeroplane. These systems include means to compensate or correct for errors induced by stable magnetic
effects in the aeroplane. Additional effects due to electromagnetic transients and configuration changes are
not normally “compensated” by the magnetic heading system and are also included in this AMC.
Should the correction become unavailable (either intentionally or unintentionally), the effects of the resulting
heading indication should be considered for safe operation of the aeroplane. This AMC addresses the
condition where correction is available and the condition where correction is not available (or failed).
In most circumstances, heading information is not directly used as the primary means of navigation. This
condition should permit the applicant to show that the accuracy adequate for the safe operation of the
aeroplane may be different than what is defined in this AMC.
1. After correction the cumulative deviation on any heading should not exceed 5°, based on the following:
a. A change in deviation due to the equipment of the heading system components, the total of which should not
exceed 2°.
b. A change in deviation due to the current flow in any item of electrical equipment and its associated wiring
is permissible, but should not exceed 1°. The total cumulative effect for all combinations of equipment, with
all combinations of electrical load, should not exceed 2°.
c. A change in deviation due to the movement of any component, (e.g. controls or undercarriage) in normal
flight is permissible, but should not exceed 1°.
2. If correction fails or is not available, the change in deviation due to the proximity of all equipment containing
magnetic material should not exceed 2°.
3. For magnetic heading indications obtained via geographic (true) heading, the accuracy of the heading
indication should account for the accuracy of the magnetic variation data based on geographic position.
This variation may change over time.
2-F-36
BOOK 2 CS-25
The applicant may propose different accuracy values after consultation with the EASA.
In areas of known magnetic unreliability (e.g. the magnetic poles), the magnetic variation error can be very
large, so the magnetic heading indications (if output) should not be relied upon.
4. For geographic (true) heading indications (such as those provided by Inertial Reference Units), the
accuracy should be better or equal to 1°.
5. For standby compass instruments, the accuracy of the magnetic heading indications after correction
should be better or equal to 10°.
Note: On aeroplanes with a short cruising range, the above limits may be extended after consultation with
EASA. For aeroplanes that do not depend on direction or heading information for navigation (VOR, ILS,
FMS, GPS), the above limits may be extended after consultation with EASA.
AMC 25.1329
Automatic Pilot
INTRODUCTION
CS 25.1329 and this AMC apply to basic automatic pilot certification. For automatic pilots, which are capable
of automatic landing or are to be used in precision approaches with a decision height below 60 m (200 ft),
supplementary airworthiness requirements apply (see CS–AWO).
1 General
1.1 For the purpose of this AMC the term ‘automatic pilot’ includes the sensors, computers, power
supplies, servo-motors/actuators and associated wiring, necessary for its function. It includes any
indications and controllers necessary for the pilot to manage and supervise the system.
1.2 Any part of the automatic pilot, which remains connected to the primary flight controls when the
automatic pilot is not in use, is regarded as a part of the primary flight controls and the provisions for such
systems are applicable.
1.3 In showing compliance with CS 25.395(b), servo-motors, their mountings and their connection to the
flight control system should have limit and ultimate factors of safety of not less than 1·0 and 1·5 respectively,
with the maximum loads which can be imposed by the automatic pilot, or by the flight control system (up to
its design load).
1.4 Adequate precautions should be taken in the design process and adequate procedures should be
specified in the maintenance manual to prevent the incorrect installation, connection or adjustment of parts
of the automatic pilot if such errors would hazard the aeroplane (e.g. torque clutches or limit switches with a
range of adjustment such that maladjustment could be hazardous).
1.5 The response of the automatic pilot should be considered in showing compliance with the structural
requirements of CS–25 Subparts C and D.
1.6 The automatic pilot should be so designed and installed that the tolerances demonstrated during
certification tests can be maintained in service.
1.7 The automatic pilot should not cause sustained nuisance oscillations, undue control activity or
sudden large attitude changes, especially when configuration or power changes are taking place.
1.8 When automatic functions are provided which may be used with the automatic pilot (e.g. automatic
throttle control or yaw damper, etc.) and use of the automatic pilot is permitted with any of these functions
inoperative, it should comply with the provisions of this AMC with these functions operative and inoperative.
2-F-37
CS-25 BOOK 2
1.9 Operating procedures for use with the automatic pilot should be established. (See CS 25.1585(a)
and (b).)
1.10 In addition to the quick release controls of CS 25.1329(d), in order to show compliance with CS
25.1309 an alternative means of disengagement, readily accessible in flight, should be provided.
1.11 It should be possible to disengage the automatic pilot at any time without unacceptable out-of-trim
forces.
2 Performance of Function
2.1 The automatic pilot should be demonstrated to perform its intended function in all configurations in
which it may be used throughout all appropriate manoeuvres and environmental conditions, including
turbulence, unless an appropriate operating limitation or statement is included in the aeroplane Flight
Manual. All manoeuvres should be accomplished smoothly, accurately and without sustained nuisance
oscillation. This demonstration should be conducted with system tolerances at the lower limits of automatic
pilot authority.
NOTE: The acceptability of the performance may be based on subjective judgement taking into account the
experience acquired from similar equipment and the general behaviour of the aeroplane. The acceptable
performance may vary according to aeroplane type and model.
2.2 If the automatic pilot is to be approved for ILS or MLS approaches, a series of approaches should
be made in the normal approach configuration(s) to the Minimum Use Height (MUH) (see paragraph 5.3.4).
These approaches should be made in conditions chosen to show that the performance is satisfactory within
permitted extremes such as weight, centre of gravity position, wind speed, capture angle and range. Unless
otherwise justified, performance should be demonstrated on at least two facilities of each type of approach
system, which is to be certificated for use with the automatic pilot. To cover this range of conditions, it can
be expected that in the order of 15 approaches will be needed. In the event that the performance is not
satisfactory down to the MUH established in accordance with paragraph 5.3.4, then the Flight Manual should
specify an MUH at which the performance is satisfactory. (An approach is considered to be satisfactory if it
is stable without large deviations from the intended path or speed during the approach and, at the MUH, the
position and velocities of the aeroplane are such that a safe landing can readily be made.)
2.3 If approval is sought for ILS or MLS approaches initiated with one engine inoperative and the
aeroplane trimmed at glide path intercept, the automatic pilot should be capable of conducting the approach
without further manual trimming.
3 Controls, Indicators and Warnings
3.1 The controls, indicators and warnings should be so designed as to minimise crew errors. Mode and
malfunction indications should be presented in a manner compatible with the procedures and assigned tasks
of the flight crew. The indications should be grouped in a logical and consistent manner and be visible from
each pilot’s station under all expected lighting conditions.
3.2 The means provided to comply with CS 25.1329(h) should also give an appropriate indication when
there is –
a. Failure to achieve the selected mode; and
2-F-38
BOOK 2 CS-25
b. Resetting the datum pressure or the selected altitude at any time during altitude acquisition does
not result in a hazardous manoeuvre.
4.2 Go-around Mode. Where the automatic pilot has the ability to carry out an automatic go-around –
a. The speed should be compatible with that used for a manually controlled go-around; it should not be
less than the higher of 1·13 VSR or the appropriate minimum control speed (see CS 25.149);
b. The control actions and flight path during the initial rotation should not be significantly different from
those of a manually controlled go-around;
c. Flight path control following an engine failure during go-around should not require exceptional
piloting skill or alertness; and
d. Any failure condition that causes the automatic pilot to fail to initiate the go-around without a
warning appropriate to the approved use of the system, should be assessed as Extremely Remote.
4.3 Control Wheel Steering Mode (CWS). Where the pilot has the ability to make inputs to the
automatic pilot by movement of the normal control wheel (control wheel steering) –
a. It should be possible for the pilot to overpower the automatic pilot and to achieve the maximum
available control surface deflection without using forces so high that the controllability requirements of CS
25.143(c) are not met;
b. The maximum bank and pitch attitudes, which can be achieved without overpowering the automatic
pilot, should be limited to those necessary for the normal operation of the aeroplane;
NOTE: Typically ± 35° in roll +20° to –10° in pitch.
c. It should be possible to perform all normal manoeuvres smoothly and accurately without nuisance
oscillation. It should be possible also to counter all normal changes of trim due to change of configuration or
power, within the range of flight conditions in which control wheel steering may be used, without
encountering excessive discontinuities in control force which might adversely affect the flight path;
d. The stall and stall recovery characteristics of the aeroplane should remain acceptable. It should be
assumed that recovery is made with CWS in use unless automatic disengagement of the automatic pilot is
provided;
e. In showing compliance with CS 25.143(f) account should be taken of such adjustments to trim as
may be carried out by the automatic pilot in the course of manoeuvres, which can reasonably be expected.
Some alleviation may be acceptable in the case of unusually prolonged manoeuvres provided the reduced
control forces would not be hazardous;
f. If the use of this mode for take-off and landing is to be permitted it should be shown that –
i. Sufficient control, both in amplitude and rate is available without encountering force discontinuities;
ii. Reasonable mishandling is not hazardous (e.g. engaging the automatic pilot while the elevators or
ailerons are held in an out-of-trim position); and
iii. Runaway rates and control forces are such that the pilot can readily overpower the automatic pilot
with no significant deviation in flight path;
iv. Any lag in aircraft response induced by the CWS mode is acceptable for the intended manoeuvre.
g. It should not be possible to revert to the CWS mode by applying a force to the control column or
wheel unless the autopilot is in a capture mode (e.g. altitude capture, localizer capture). When the force is
released the autopilot should return to the previously engaged capture mode or to the track mode.
5 Failure Conditions
5.1 Analysis
5.1.1 An analysis should be carried out to define the Failure Conditions and their Effects and to show that
the probability of each Failure Condition is such that the provisions of paragraph 5.2 are achieved. The
depth of the analysis may be significantly reduced and numerical probability analysis may not be required in
the case of a single-channel automatic pilot if worst-case failures can be easily identified and used as the
2-F-39
CS-25 BOOK 2
basis of a ground and flight test demonstration programme (e.g. where the effect of a failure is limited by an
independent device whose serviceability is frequently checked).
5.1.2 When the failure of a device can remain undetected in normal operation, the frequency with which
the device is checked will directly influence the probability that such a failure is present on any particular
occasion. This should be taken into account when assessing the probabilities of any Failure Conditions,
which include dormant failures in the monitoring devices or in other unchecked parts of the system (see
paragraph 5.1.6).
5.1.3 When the failure of a component or equipment can be expected to result in other failures, then
these further failures should be taken into account in the analysis. In assessing which further failures may
occur, consideration should be given to any change in the equipment operating conditions for other
components or equipment resulting from the first failure.
5.1.4 In considering damage from external sources, account should be taken of the location of the
equipment in the aeroplane and other features of the installation.
5.1.5 Attention should be given in the analysis to common mode failures (i.e. multiple failures arising from
a single cause). The following are examples:
a. A local fire causing multiple fractures;
b. Electromagnetic interference or electrical transients causing multiple malfunctions;
a. A load on any part of the primary structure sufficient to cause a catastrophic structural failure;
b. Catastrophic loss of flight path control;
c. Exceedance of VDF/MDF; or
d. Catastrophic flutter or vibration.
5.2.2 Any Failure Condition occurring within the normal flight envelope should be assessed as Extremely
Remote if its effect is one of the following:
a. A load on any part of the structure greater than its limit load;
b. Exceedance of airspeed halfway between VMO and VDF or a Mach number halfway between MMO and
MDF;
c. A stall;
d. A normal acceleration less than a value of 0 g;
e. Bank angles of more than 60° en route or more than 30° below a height of 305 m (1000 ft). If the
MUH is below 30m (100 ft), the bank angle exceedance limit should be reduced to a value, which takes
account of the size of the aeroplane and its handling characteristics;
2-F-40
BOOK 2 CS-25
g. Hazardous height loss in relation to minimum permitted height for automatic pilot use (see
paragraph 5.3); or
h. Engagement or disengagement of a mode leading to hazardous consequences.
5.2.3 Any Failure Condition for which the probability of occurrence is assessed as Remote should have
an appropriately less severe effect than those listed in paragraph 5.2.2.
5.2.4 Compliance with the requirements of paragraphs 5.2.1, 5.2.2 and 5.2.3 should be shown by ground
simulation, flight tests or suitable analysis. Where appropriate, account should be taken of pilot recognition
of the Failure Condition, and any subsequent recovery action taken. The limiting values given in paragraph
5.2.2 should not be exceeded either during any manoeuvre caused by the failure or during the recovery by
the pilot. The minimum heights at which the automatic pilot may be used should be determined.
5.2.5 The most critical of the Failure Conditions which are not assessed as Extremely Remote or
Extremely Improbable should be demonstrated in flight test (see paragraph 5.3). Failure Conditions, which
are assessed as Extremely Remote, may be demonstrated by a ground simulation or analysis, which has
been suitably validated, using the same procedures as are specified in paragraph 5.3 for flight test.
5.3 Flight Demonstrations. When demonstrating compliance with paragraph 5.2 by means of flight test,
the following procedures should be used:
5.3.1 General
a. Failure Conditions of the automatic pilot including, where appropriate, multi-axis failures and
automatic-trim failures, should be simulated in such a manner as to represent the overall effect of each
Failure Condition about all axes.
b. Following recognition of the Failure Condition b the pilot, a delay, as specified in paragraphs 5.3.2,
5.3.3, 5.3.4 and 5.3.5 should be applied before the commencement of recovery action. Following such delay
the pilot should be able to return the aeroplane to its normal flight attitude under full manual control without
engaging in any dangerous manoeuvres during recovery and without control forces exceeding the values
given in CS 25.143(c). During the recovery the pilot may overpower the automatic pilot or disengage it. For
the purpose of determining the minimum height at which the autopilot may be used during an approach, a
normal acceleration of the order of 15 g should be applied. Such an acceleration should not lead to an
unsafe speed excursion during the manoeuvre to resume a normal flight path.
c. System authority should be set at the most adverse tolerance limits unless an analysis shows that
they have no significant effect and the flight conditions should be the most critical which is appropriate
(centre of gravity, weight, flap setting, altitude, speed, power or thrust).
d. In malfunction tests described in paragraphs 5.3.2, 5.3.3, 5.3.4 and 5.3.5 the recognition point
should be that at which a pilot in service operation in non-visual conditions may be expected to recognise the
need to take action and not that at which the test pilot engaged in the flight trials does so. Recognition of
the malfunction may be through the behaviour of the aeroplane or an appropriate failure warning system and
the recognition point should be identified. Control column or wheel movements alone should not be used for
recognition. The recognition time should not normally be less than 1 second. If a recognition time of less
than 1 second is claimed, specific justification will be required (e.g. additional tests to ensure that the time is
representative in the light of the cues available to the pilot).
e. If any auto throttle system is installed, the tests should be performed with the auto throttle system
engaged or disengaged whichever is the more adverse case.
f. For control wheel steering, in those phases of flight where the pilot is exercising manual control
(e.g. take-off, landing) the delay times specified in paragraphs 5.3.2, 5.3.3, and 5.3.5 need not be applied.
The pilot may commence recovery action at the recognition point. (See also paragraph 4.3 f.)
g. The aeroplane should be so instrumented that the parameters appropriate to the test are recorded
(e.g. normal acceleration, airspeed, height, pitch and roll angles, automatic pilot engagement state). The
fitment of the instrumentation should not affect the behaviour of the automatic pilot or any other system.
2-F-41
CS-25 BOOK 2
a. Recovery action should not be initiated until three seconds after the recognition point.
b. The MUH for the automatic pilot in climb, cruise, descent or holding should not be less than
305 m (1000 ft), unless the height loss is determined under the conditions for which use of the automatic
pilot is requested. In that case the MUH should not be less than twice the height loss. The height loss is
measured as the difference between the height at the time the malfunction is induced to the lowest height in
the recovery manoeuvre.
a. The aircraft should be flown down the glide path in the configuration and at the approach speed
specified. Simulated automatic pilot malfunctions should be induced at critical points during the approach,
taking into consideration all possible design variations in automatic pilot system sensitivity and authority. In
general, malfunction demonstrations may be restricted to hard-overs (and possibly automatic-trim failures)
unless an MUH below 30m (100 ft) is requested, when runaways at lower rates should also be investigated
iii. The point where the pilot indicates recognition of the malfunction; and
iv. The point along the path of the aeroplane where the recovery action is initiated.
d. Recoveries from malfunction should simulate non-visual conditions with a one-second-time delay
between recognition point and initiation of recovery.
e. The MUH should be determined as the height of the aeroplane wheels at the point where recovery
from the failure is initiated when the path of the aeroplane wheels during the recovery manoeuvre is tangent
to the runway or to a 1:29 slope line drawn from a point 4.6 m (15 ft) above the runway threshold (See
Figure 1). If there is no automatic landing capability, the MUH should not be less than 15m (50 ft).
f. An engine failure should not cause a heading change at a rate greater than three degrees per
second averaged over a five second period, or produce hazardous attitudes (see also paragraph 5.2.2 e.).
In showing compliance with this, manual retrimming of the aeroplane is not permitted.
5.3.5 Approach not coupled to ILS or MLS vertical guidance
a. The procedure described in paragraphs 5.3.4 a. to f. should be applied.
b. A descent path of three degrees should be used unless the automatic pilot is to be approved for
significantly steeper descents.
c. The MUH for the automatic pilot should not be less than twice the height loss, where the height loss
is measured as described in paragraph 5.3.2 b.
5.3.6 Failure to disengage. Unless failure of the automatic pilot to disengage during the approach when
the pilot operates the quick release control on the control wheel is assessed as Extremely Remote it should
be demonstrated that the pilot could control the aeroplane manually without operating any of the other
disengagement controls.
5.3.7 Automatic Pilot Engagement below 305 m (1000 ft) after Take-Off
a. The minimum altitude at which the automatic pilot may be engaged should be the greatest of the
following:
2-F-42
BOOK 2 CS-25
i. The altitude at which, in an all-engines take-off at the WAT limit using the AFM procedures, the
aeroplane response and recovery manoeuvre resulting from the worst case nose down hardover does not
penetrate the net flight path as defined in CS 25.115.
ii. The altitude at which, in an all-engines take-off at the WAT limit using the AFM procedures, the
aeroplane has reached an airspeed so that the manoeuvre resulting from the worst case nose up hardover
does not result in an unsafe speed in the whole manoeuvre – including the pilot recovery.
iii. The altitude at which the stall identification system (e.g. stick pusher) is armed (if installed).
iv. The altitude at which the practicability of crew procedures to engage the autopilot has been
demonstrated.
b. The automatic pilot should not command, in response to the loss of an engine, a manoeuvre
resulting in an unsafe attitude such that the pilot, without using exceptional skill or strength, cannot safely
take over control of the aeroplane.
5.4.2 The investigation may be accomplished largely through analysis with sufficient flight data to verify
the analytical studies or largely through flight tests with analytical studies extending the flight data to the
conditions, which impose the highest percentage of limit, load to the parts.
5.4.3 When flight tests are conducted in which the signal frequency is continuously swept through a
range, the rate of frequency change should be slow enough to permit determining the amplitude of response
of any part under steady frequency oscillation at any critical frequency within the test range.
2-F-43
CS-25
2-F-44
FIGURE 1 - DEVIATION PROFILE METHOD FOR DETERMINING
MINIMUM HEIGHT AT WHICH THE AUTOMATIC PILOT MAY BE USED
(MUH) ON AN ILS OR MLS COUPLED APPROACH
BOOK 2
BOOK 2 CS-25
AMC 25.1333(b)
Instruments systems
1. Attitude displays systems. If three displays are used to show compliance with CS 25.1333(b), the reliability
and independence of those displays should be confirmed by a suitable assessment in accordance with CS
25.1309. Each display should have independent sensors and power supplies. If a total failure of the
generated electrical power causes the loss of both main instruments, the power supply to the third (standby)
attitude indicator and its appropriate lighting should be such that the display is usable from each pilot’s
station for a time duration in accordance with AMC 25.1351(d).
Note: the time for which the display remains usable will be stated in the Aeroplane Flight Manual (AFM).
2. Airspeed, altitude, and direction display systems. The reliability and independence of the displays used to
show compliance with CS 25.1333(b) should be sufficient to ensure continued safe flight and landing
appropriate to the intended operation of the aeroplane.
Historically, “sufficient information” to control attitude, airspeed, altitude, and direction has been provided by
specific indicators of the state of each parameter. However, since control is considered to be the ability to
change or maintain a given parameter to a desired value, it is assumed that these parameters will be
available without flight crew action.
There may be alternate parameters in the cockpit that provide equivalent means to control attitude, airspeed,
altitude and direction, without displaying those parameters directly (for example, without display of standby
airspeed, by using a suitable angle-of-attack display). For these alternate cases, compliance to CS
25.1333(b) must be shown by analysis and flight test.
AMC 25.1351(b)(5)
Generating System
1 The disconnect means required by CS 25.1351(b)(5) should be accessible to the appropriate flight-
crew members in their normal seated positions.
2 The power source controls should be considered as cockpit controls and therefore also comply with
CS 25.777.
3 It may not be necessary to provide disconnection controls for all power sources, for example RAT
generators or engine control dedicated generators. Where it is necessary to isolate the alternate power
source when normal generator power is restored, such isolation should be possible.
AMC 25.1351(b)(6)
Generating System
Each source of electrical supply (e.g. generators and batteries) should be provided with means to give
the flight crew immediate warning of the failure of its output. These warning means are additional to the
system indication requirements of CS 25.1351(b)(6). For multiphase systems the warning should also
indicate the loss of any phase.
AMC 25.1351(d)
Operation without Normal Electrical Power
1 Provision should be made to ensure adequate electrical supplies to those services, which are
necessary to complete the flight and make a safe landing in the event of a failure of all normal generated
electrical power. All components and wiring of the alternate supplies should be physically and electrically
segregated from the normal system and be such that no single failure, including the effects of fire, the
cutting of a cable bundle, the loss of a junction box or control panel, will affect both normal and alternate
supplies.
2-F-45
CS-25 BOOK 2
2 When ensuring the adequacy of electrical supplies relative to alternate power source duration and
integrity, special consideration should be given to aeroplanes such as those with fly-by-wire, for which the
total loss of electrical supplies could result in an immediate loss of control.
3 In considering the services which should remain available following the loss of the normal generated
electrical power systems, consideration should be given to the role and flight conditions of the aeroplane and
the possible duration of flight time to reach an airfield and make a safe landing.
4 The services required by CS 25.1351(d)(1) may differ between aeroplane types and roles and
should be agreed with the Agency. These should normally include –
a. Attitude information;
b. Radio communication and intercommunication;
c. Navigation;
Restart capability with critical type fuel (from the standpoint of flame-out and restart capability) and with the
aeroplane initially at the maximum certificated altitude;
h. Adequate engine instrumentation;
i. Such warning, cautions and indications as are required for continued safe flight and landing;
j. Any other services required for continued safe flight and landing.
5 Consideration should also be given to the equipment and the duration of services required to make
a controlled descent and forced landing in the event of failure and inability to restart all engines.
6 Alternate Power Source Duration and Integrity
6.1 Time Limited. Where an alternate power source provided to comply with CS 25.1351(d) is time
limited (e.g. battery), the required duration will depend on the type and role of the aeroplane. Unless it can
be shown that a lesser time is adequate, such a power source should have an endurance of at least 60
minutes, at least 30 minutes of which is available under IMC. An endurance of less than 30 minutes under
IMC would not normally be acceptable. The endurances, with any associated procedures, should be
specified in the Flight Manual. The endurance time should be determined by calculation or test, due to
allowance being made for –
a. Delays in flight crew recognition of failures and completion of the appropriate drill where flight crew
action is necessary. This should be assumed to be 5 minutes provided that the failure warning system has
clear and unambiguous attention-getting characteristics and where such a delay is acceptable and
compatible with the crew’s primary attention being given to other vital actions.
b. The minimum voltage acceptable for the required loads, the battery state of charge, the minimum
capacity permitted during service life and the battery efficiency at the discharge rates and temperatures
likely to be experienced. Unless otherwise agreed, for the purpose of this calculation, a battery capacity at
normal ambient conditions of 80% of the nameplate rated capacity, at the one-hour rate, and a 90% state of
charge, may be assumed (i.e. 72% of nominal demonstrated rated capacity at +20°C). The allowance for
battery endurance presumes that adequate requirements for periodic battery maintenance have been
agreed.
c. For those aeroplanes where the battery is also used for engine or APU starting on the ground, it
should be shown that following engine starts, the charge rate of the battery is such that the battery is
maintained in a state of charge that will ensure adequate alternate power source duration should a failure of
generated power occur shortly after take-off.
NOTE: This may normally be achieved by ensuring that, following battery-powered starting, the battery
charge current has fallen to a declared level prior to take-off.
2-F-46
BOOK 2 CS-25
d. For those aeroplanes where the battery is used for in-flight starting of the engines or APU, it may be
necessary to include limitations on the number of attempted starts, or to provide a separate dedicated
battery for such purposes.
6.2 Non-Time Limited. Where an alternate electrical supply is provided by a non time limited source,
e.g. APU, ram air turbine, pneumatic or hydraulic motor, due account should be taken of any limitation
imposed by aeroplane speed, attitude, altitude etc., which may affect the capabilities of that power source.
In considering the power source, account should be taken of the following:
a. Auxiliary Power Unit (APU). An APU capable of continuous operation throughout an adequate flight
envelope may be considered an acceptable means of supplying electrical power to the required services
provided that its air start capability is adequate and may be guaranteed. Where, however the APU is
dependent for its starting current on a battery source, which is supplying critical loads, such starting loads
may prejudice the time duration of the flight if APU start is not achieved.
It may be necessary therefore to include limitations on the number of attempted starts or to provide a
separate battery for APU starting, if this method of supplying electrical power is adopted. Consideration
should also be given to the equipment, services and duration required prior to the APU generator coming on-
line. Common failures, which could affect the operation of all engines and the APU, should be taken into
consideration, e.g. fuel supply.
b. Ram Air Turbine (RAT). A ram air turbine may be utilised to provide an alternate electrical power
source, but due consideration must be given to ensuring that the means of bringing the unit into use are not
dependent on a source which may have been lost as a result of the original failure. This will normally
necessitate independent, duplicate means of deployment. Particular attention should be given to ensuring
that the RAT and its means of deployment satisfy the overall reliability requirements.
The continuity of electrical power to those services which must remain operative without crew action prior to
the RAT being brought into operation, may necessitate the use of a battery, unless the operation of the
emergency power source is automatic and is supplying power within a timespan so as not to jeopardise the
continued safety of the aeroplane in the event of failure of normal generated electrical power.
c. Pneumatic or Hydraulic Motor Drive Power Source. A pneumatic or hydraulic motor driven electrical
power source may be utilised subject to the same constraints on activation as the ram air turbine (see
6.2(b)). Care should be taken in ensuring that the operation of the pneumatic or hydraulic system is not
prejudiced by faults leading to, or resulting from, the original failure, including the loss of, or inability to
restart all engines.
d. Regaining of Main Generators. In the event of a major loss of electrical power, provision may be
made for regaining the output of one or more generators using separate control and switching arrangements
on the generator side of the normal generator line contactor. Such a system would not normally be
acceptable on aeroplanes with less than three engine-driven generators, as the probability of the loss of all
engine-driven generators is unlikely to meet the requirements of CS 25.1351(d). To comply with CS
25.1351(d)(2) the system should be designed such that the loss of both the main and alternate means of
control and distribution is Extremely Improbable. Consideration should be given to the services and duration
required prior to the activation of the system and to enable a descent and forced landing to be made, in the
event of the inability to restart all engines.
AMC 25.1353(a)
Electrical Equipment and Installations
a. Conducted and radiated interference caused by electrical noise generation from apparatus
connected to the busbars,
b. Coupling between electrical cables or between cables and aerial feeders,
c. Malfunctioning of electrically-powered apparatus,
d. Parasitic currents and voltages in the electrical distribution and earth systems, including the effects
of lightning currents or static discharge,
2-F-47
CS-25 BOOK 2
Where temperature sensing and over-temperature warning devices are installed to comply with CS
25.1353(c)(6)(ii) or (iii), their correct operations should be verified at agreed maintenance intervals in
addition to compliance with CS 25.1309(a) and (b).
AMC 25.1355(c)
Distribution System
The arrangement, protection and control of the feeders from the busbars to the distribution points, and the
divisions of loads among the feeders, should be such that no single fault occurring in any feeder or
associated control circuit will hazard the aeroplane.
AMC 25.1357(a)
Circuit Protective Devices
No hazard should result from the effects of variations in ambient temperatures on either the protective
device or the equipment it protects. See also CS 25.1309.
AMC 25.1360(a)
Protection Against Injury
1 Where there may be a hazard during maintenance or servicing, aeroplane panels, etc., carrying
voltages of above 50V RMS, should be marked with the voltage.
2 Where socket outlets are provided, these should be labelled as to use and with the output voltage or
voltages. Where the output voltage exceeds 100 volts d.c. and/or 50 volts a.c. RMS either the output should
be electrically isolated from the aeroplane structure, or means shall be provided to prevent inadvertent
contact with live parts.
AMC 25.1360(b)
Protection Against Injury
1 For equipment which has to be handled during normal operation by the flight or cabin crew, a
temperature rise of the order of 25°C, for metal parts, should not be exceeded. For other equipment,
mounted in parts of the aeroplane normally accessible to passengers or crew, or which may come into
contact with objects such as clothing or paper, the surface temperature should not exceed 100°C, in an
ambient temperature of 20°C.
2 The heating surfaces of properly installed cooking apparatus are excluded from these requirements.
3 The provision of guards around hot surfaces is an acceptable method of complying with these
requirements.
AMC 25.1362
Electrical Supplies for Emergency Conditions
1 The emergency services which may require a supply include fuel shut-off valves, hydraulic shut-off
valves and engine / APU fire extinguisher systems.
2-F-48
BOOK 2 CS-25
2 An appropriate design and/or unambiguous AFM procedures should be provided in order to prevent
disconnection of the electrical supply to the required services before the emergency procedures are fully
completed.
AMC 25.1363
Electrical Systems Tests
1 In carrying out the tests due account should be taken of load switching and flight crew operation of
the system.
2 Laboratory or Ground Tests
2.1 All tests should be carried out with all equipment as representative as possible of the actual
aeroplane. In particular, the simulation should include the correct representation of aeroplane cables in size,
length and impedance, the correct ground (airframe) impedance and relative ground plane location and their
location to other cables or systems that could influence performance. System loads and the generator drive
system should also be correctly simulated.
2.2 The tests may be carried out on representative laboratory rigs or in an actual aeroplane, as
appropriate.
2.3 Test procedures should be prepared to cover each test condition in the programme.
AMC 25.1365
Electrical appliances, motors and transformers
In showing compliance with CS 25.1365(a), the following should be taken into consideration:
1.1 The design and installation of heated domestic appliances should be such that no single failure (e.g.
welded thermostat or contactor, loss of water supply) can result in dangerous overheating and consequent
risk of fire or smoke or injury to occupants.
An acceptable method of achieving this is by the provision of a means independent of the normal
temperature control system, which will automatically interrupt the electrical power supply to the unit in the
event of an overheat condition occurring. The means adopted should be such that it cannot be reset in flight.
1.2 The design and installation of microwave ovens should be such that no hazard could be caused to
the occupants or the equipment of the aeroplane under either normal operation or single failure conditions.
1.3 Heated liquid containers, e.g. water boilers, coffee makers should, in addition to overheat
protection, be provided with an effective means to relieve overpressure, either in the equipment itself or in its
installations.
1.4 When considering failures of domestic appliances, the effect of the loss of the water supply to a
water heater, with the electrical supply maintained, should be taken into account.
2-F-49
CS-25 BOOK 2
NOTES:
Due account should be taken of the possible effects of lime scale deposit both in the design and
maintenance procedures of water heating equipment.
The design of galley and cooking appliance installations should be such as to facilitate cleaning to limit the
accumulation of extraneous substances, which may constitute a fire risk.
In showing compliance with CS 25.1365(d), the following should be taken into consideration:
a. Failures of any automatic control systems, e.g. automatic timer systems, which may cause the
motor to run continuously;
b. Short circuit failures of motor windings or transformer windings to each other or to the motor or
transformer frame;
c. Open circuit of one or more phases on multi-phase motors;
d. Motor seizures;
e. The proximity of flammable materials or fluids;
f. The proximity of other aeroplane installations;
g. Spillage of fluids, such as toilet waste;
h. Accumulation of combustible material; and
i. Cooling air discharge under normal operating or failure conditions.
3. Water Systems
3.1 Where water is provided in the aeroplane for consumption, or use by the occupant, the associated
system should be designed so as to ensure that no hazard to the aeroplane could result from water coming
into contact with electrical or other systems.
3.2 Service connections (filling points) should be of a different type from those used for other services,
such that water could not inadvertently be introduced into the systems for other services.
AMC 25.1419
Ice Protection
1.3 Additional material, based on UK practice, appropriate to operating in ice crystal conditions is given
in 4. This material should be used only where design features of the aeroplane are susceptible to this form
of icing.
2 Method 1 (Acceptable Means of Compliance)
2.1 Any part of the aeroplane (including its equipment) which is susceptible to ice accretion in ice
forming conditions, should be subjected to such evaluation as would demonstrate the suitability of the
aeroplane to fly in the ice forming conditions defined in CS Appendix C.
2.2 For the purposes of analysis and tests on protected surfaces the conditions of Figures 1, 2, 4 and 5
only of Appendix C should apply. In determining the rates of catch, the full spectrum of the droplet sizes
should be considered but in determining impingement areas, a maximum droplet size of 50 µm need only be
considered.
2-F-50
BOOK 2 CS-25
2.3 The natural icing tests carried out on the aeroplane will be judged for their acceptability by
evaluation of icing conditions through which the aeroplane has flown in relation to the envelope of conditions
of Appendix C.
2.4 Where there are parts of the aeroplane, which are not amenable to analysis, or when testing is
considered necessary, the following paragraphs describe an acceptable method of demonstration that the
requirements are complied with.
2.5 Protected and Unprotected Parts of the Airframe
2.5.1 General. When considering simulated icing tests, the flight conditions selected for testing at each
temperature should be the most unfavourable taking account of aeroplane speed, altitude, angle of
incidence and power supply. Where altitude is a critical parameter, the tests should be conducted in flight or
on the ground so as to simulate the effects of altitude. When the tests are conducted in non-altitude
conditions the system supply and the external aerodynamic and atmospheric conditions should be so
modified as to represent the required altitude conditions as closely as possible.
2.5.2 Tests in Continuous Maximum Conditions
a. Those parts of the airframe where the accretion of ice under the conditions of Appendix C is likely to
have an adverse effect on the airworthiness of the aeroplane, should be tested for a period of 30 minutes
duration at each of the conditions specified in the following Table 1.
TABLE 1
0 0·8
–10 0·6
–20 0·3 20
–30 0·2
b. At the end of the tests the total ice accretion should be such as not to adversely affect the safety of
the aeroplane.
c. The duration of the above tests can be reduced if it can be demonstrated that the surface is
completely ice free or that the total ice accretion is obviously contained by repetitive shedding either
naturally or enforced by cyclic operation of the protective system.
2.5.3 Check Concerning Intermittent Maximum Conditions. It would be necessary to check that
Intermittent Maximum icing conditions of Figures 4 and 5 of Appendix C do not hazard the aeroplane. The
encounters considered should include three clouds of 5 km horizontal extent with Intermittent Maximum
concentrations as in Table 2 separated by spaces of clear air of 5 km.
TABLE 2
0 2·5
–10 2·2
–20 1·7 20
–30 1·0
2-F-51
CS-25 BOOK 2
a. Where ice can accrete on unprotected parts it should be demonstrated that the effect of such ice
would not critically affect the characteristics of the aeroplane as regards safety (e.g. flight, structure and
flutter). The subsequent operation of retractable devices should be considered.
b. Irrespective of what is required by paragraphs 2.5.2 and 2.5.3 from service experience the amount
of ice on the most critical unprotected main aero-foil surface need not exceed a pinnacle height of 75 mm (3
in) in a plane in the direction of flight. For other unprotected main surfaces an analysis may be performed to
determine the maximum ice accretion associated with this maximum pinnacle height. In the absence of such
an acceptable analysis a uniform pinnacle height of 75 mm (3 in) should be assumed. The shape and
apparent density, taking into account the texture of the ice, are important. Unless suitable evidence is
already available, icing tests should be conducted to determine the critical values of these properties.
c. The critical ice accretion on unprotected parts will normally occur during the hold near 4572 m
(15 000 feet) at about –10°C so as to give a total temperature of around 0°C.
2.5.5 Ice Shedding. Parts of the aeroplane, which can accrete ice, which upon shedding could interfere
with the continuous safe operation of the engines or essential services, should be so protected as to prevent
the shedding of ice having more than critical dimensions for the engine or device or it should be
demonstrated that the trajectories of such ice are not critical. The protection or otherwise should be
demonstrated assuming the ice conditions against which the engine air intake is required to be
demonstrated.
2.5.6 Essential Equipment. Tests should be conducted to the same standard as recommended for
turbine engine air intakes (see AMC 25.1093(b)(1)) unless it can be shown that the items are so designed
and located as not to be susceptible to icing conditions. Ice crystal and mixed ice and water cloud will need
to be considered. However, in conducting these tests due regard should be given to the presence of the
aeroplane and its effect on the local concentration of the cloud.
3 Method 2 (Interpretative Material)
3.1 Any part of the aeroplane (including its equipment) which is susceptible to ice accretion in ice-
forming conditions, should be subjected to such evaluations as would demonstrate the suitability of the
aeroplane to fly in ice-forming conditions defined in CS 25, Appendix C, using FAA Advisory Circular AC 20-
73, dated 21st April, 1971, and FAA Technical Report ADS4, dated March, 1964.
3.2 Factors, which should be considered in the evaluation, are –
a. The meteorological conditions of Appendix C,
b. The operational conditions which would affect the accumulation of ice on protected and unprotected
surfaces of the aeroplane,
c. The operational conditions of the engine and propeller (if applicable) which would affect the
accumulation of ice and/or the availability of energy to operate systems, and
d. The local condition resulting from installation on the aeroplane.
3.3 For the purpose of analysis and tests on protected and unprotected surfaces, all Figures 1 to 6 of
Appendix C are used. In determining the more critical conditions of rate of catch and limits of impingements,
the full spectrum of droplet sizes should be considered, taking into account the droplet size distribution
(Langmuir D distribution is acceptable for this use).
3.4 The natural icing tests carried out on the aeroplane will be judged for their acceptability by the
evaluation of the icing conditions through which the aeroplane has flown in relation to the envelope of
conditions of Appendix C.
3.5 In following the alternative procedures as listed in CS 25.1419(c)(1) and (3), the conditions selected
for testing should be the most critical as determined from the analysis.
3.6 Where ice can accrete on protected or unprotected parts it should be demonstrated that the effect
of such ice will not critically affect the characteristics of the aeroplane as regards safety (e.g. flight, structure
and flutter). The subsequent operation of retractable safety devices should be considered.
2-F-52
BOOK 2 CS-25
3.7 From service experience the amount of ice on the most critical unprotected main aerofoil surface
need not usually exceed a pinnacle height of 75 mm (3 in) in a plane in the direction of flight. For other
unprotected main surfaces an analysis may be performed to determine the maximum ice accretion
associated with this maximum pinnacle height. In the absence of such an acceptable analysis a uniform
pinnacle height of 75 m (3 in) should be assumed. The shape and apparent density, taking into account the
texture of the ice, are important. Unless suitable evidence is already available, icing tests should be
conducted to determine the critical values of these properties.
3.8 The critical ice accretion on unprotected parts will normally occur during the hold near
4572 m (15 000) feet so as to give a total temperature of around 0°C.
3.9 Parts of the aeroplane which can accrete ice, which, upon shedding, could interfere with the
continuous safe operation of the engines or essential services should, if necessary, be so protected as to
prevent the shedding of ice having more than critical dimensions for the engine or device, or it should be
demonstrated that the trajectories of such ice are not critical.
4 Ice Crystal Conditions. An assessment should be made into the vulnerability of the aeroplane and
its systems to ice crystal conditions.
4.1 The parts most likely to be vulnerable are –
a. Turbine engine intakes with bends, particularly reverse flow (see CS 25.1093), and
4.3 Where any doubt exists as to the safe operation in ice crystal conditions appropriate tests should be
conducted to establish the proper functioning of the system likely to be affected.
4.4 For guidance Table 3 gives provisional details of the conditions likely to be encountered in service.
TABLE 3
Air Temperature (°C) Altitude Range Maximum Crystal Horizontal Extend Mean Particle
Content Diameter
to to 2·0 20 (10)
NOTES:
1 In the temperature range 0 to –10°C the ice crystals are likely to be mixed with water droplets (with
a maximum diameter of 2 mm) up to a content of 1 g/m3 or half the total content whichever is the lesser, the
total content remaining numerically the same.
2 The source of information is RAE Tech Note, Mech. Eng. 283 dated May 1959.
2-F-53
CS-25 BOOK 2
AMC 25.1435
Hydraulic Systems - Design, Test, Analysis and Certification
1. PURPOSE
This AMC (Acceptable Means of Compliance), which is similar to the FAA Advisory Circular AC 25.1435-1,
provides advice and guidance on the interpretation of the requirements and on the acceptable means, but
not the only means, of demonstrating compliance with the requirements of CS 25.1435. It also identifies
other paragraphs of the Certification Specifications (CS) that contain related requirements and other related
and complementary documents.
The advice and guidance provided does not in any way constitute additional requirements but reflects what
is normally expected by the EASA.
CS-25 Paragraphs (and their associated AMC material where applicable) that prescribe requirements related
to the design substantiation and certification of hydraulic systems and elements include:
CS 25.301 Loads
CS 25.303 Factor of safety
CS 25.863 Flammable fluid fire protection
CS 25.1183 Flammable fluid-carrying components
CS 25.1185 Flammable fluids
CS 25.1189 Shutoff means
CS 25.1301 Function and installation
CS 25.1309 Equipment, systems and installations
CS 25.1322 Warning, caution and advisory lights
CS 25.1541 General: Markings and Placards
Additional CS-25 paragraphs (and their associated AMC material where applicable) that prescribe
requirements which can have a significant impact on the overall design and configuration of hydraulic
systems are, but are not limited to:
Documents, which are considered to provide appropriate standards for the design substantiation and
certification of hydraulic systems and system elements may include, but are not limited to:
ARP 4752 Aerospace - Design and Installation of Commercial Transport Aircraft Hydraulic
Systems
2-F-54
BOOK 2 CS-25
Note: This document provides a wide range of Civil, Military and Industry document references and
standards, which may be appropriate.
ISO 7137 Environmental Conditions and Test Procedures for Airborne Equipment
Certification Specification No. 20 AMC 20.6 Temporary Guidance Material for Extended
Range Operation with Two-Engine Aeroplanes ETOPS
Certification and Operation
ED-14D/RTCA DO-160D Environmental Conditions and Test Procedures for Airborne Equipment
(1) Ref. CS 25.1435(a)(1) The design operating pressure (DOP) is the normal maximum steady
pressure. Excluded are reasonable tolerances, and transient pressure effects such as may arise from
acceptable pump ripple or reactions to system functioning, or demands that may affect fatigue. Fatigue is
addressed in sub-paragraph (a)(4) of this paragraph.
The DOP for low-pressure elements (e.g., return, case-drain, suction, reservoirs, etc.) is the maximum
pressure expected to occur during normal user system operating modes. Included are transient pressures
that may occur during separate or simultaneous operation of user systems such as slats, flaps, landing
gears, thrust reverses, flight controls, power transfer units, etc. Short term transient pressures, commonly
referred to as pressure spikes, that may occur during the selection and operation of user systems (e.g.,
those pressure transients due to the opening and closing of selector/control valves, etc.) may be excluded,
provided the fatigue effect of such transients is addressed in accordance with sub-paragraph (a)(4) of this
paragraph.
In local areas of systems and elements the DOP may be different from the above due to the range of
normally anticipated aeroplane operational, dynamic and environmental conditions. Such differences should
be taken into account.
At proof pressure, seal leakage not exceeding the allowed maximum in-service leak rate is permitted. Each
element should be able to perform its intended functions when the DOP is restored.
For sub-paragraphs (a)(1), (a)(2) and (a)(3) of this paragraph, the pressure and structural loads, as
applicable, should be sustained for sufficient time to enable adequate determination that compliance is
demonstrated. Typically a time of 2 minutes for proof conditions and 1 minute for ultimate conditions will be
considered acceptable.
The term "pressure vessels" is not intended to include small volume elements such as lines, fittings, gauges,
etc. It may be necessary to use special factors for elements fabricated from non-metallic/composite
materials.
(2) Ref. CS 25.1435(a)(2) Limit structural loads are defined in CS 25.301(a). The loading conditions
of CS-25, subpart C to be considered include, but are not limited to, flight and ground manoeuvres, and gust
2-F-55
CS-25 BOOK 2
and turbulence conditions. The loads arising in these conditions should be combined with the maximum
hydraulic pressures, including transients that could occur simultaneously. Where appropriate, thermal
effects should also be accounted for in the strength justification. For hydraulic actuators equipped with
hydraulic or mechanical locking features, such as flight control actuators and power steering actuators, the
actuators and other loaded elements should be designed for the most severe combination of internal and
external loads that may occur in use. For hydraulic actuators that are free to move with external loads, i.e.
do not have locking features, the structural loads are the same as the loads produced by the hydraulic
actuators. At limit load, seal leakage not exceeding the allowed maximum in-service leak rate is permitted.
(3) Ref. CS 25.1435(a)(3) For compliance, the combined effects of the ultimate structural load(s) as
defined in CS 25.301 and 25.303 and the DOP, which can reasonably occur simultaneously, should be taken
into account with a factor of 1.5 applied to the DOP. In this case the overall structural integrity of the
element should be maintained. However, it may be permissible for this element to suffer leakage,
permanent deformation, operational/functional failure or any combination of these conditions. Where
appropriate, thermal effects should also be accounted for in the strength justification.
(4) Ref. CS 25.1435(a)(4) Fatigue, the repeated load cycles of an element, is a significant
contributor to element failure. Hydraulic elements are mainly subjected to pressure loads, but may also see
externally induced load cycles (e.g. structural, thermal, etc.). The applicant should define the load cycles
for each element. The number of load cycles should be evaluated to produce equivalent fatigue damage
encountered during the life of the aeroplane or to support the assumptions used in demonstrating
compliance with CS 25.1309. For example, if the failure analysis of the system allows that an element
failure may occur at 25% of aeroplane life, the element fatigue life should at least support this assumption.
(5) Ref. CS 25.1435(a)(5) Aeroplane environmental conditions that an element should be designed
for are those under which proper function is required. They may include, but are not limited to temperature,
humidity, vibration, acceleration forces, icing, ambient pressure, electromagnetic effects, salt spray, cleaning
agents, galvanic, sand, dust and fungus. They may be location specific (e.g., in pressurised cabin vs. in un-
pressurised area) or general (e.g. attitude). For further guidance on environmental testing, suitable
references include, but are not limited to, Military Standard, MIL-STD-810 "Environmental Test Methods and
Engineering Guidelines", The European Organisation for Civil Aviation Equipment Document ED-14D
"Environmental Conditions and Test Procedures for Airborne Equipment" or International Organisation for
Standardisation Document No. ISO 7137 "Environmental Conditions and Test Procedures for Airborne
Equipment".
Ref. CS 25.1435(b) Design features that should be considered for the elimination of undesirable
conditions and effects are:
(a) Design and install hydraulic pumps such that loss of fluid to or from the pump cannot lead to events that
create a hazard that might prevent continued safe operation. For example, engine driven pump shaft seal
failure or leakage in combination with a blocked fluid drain, resulting in engine gearbox contamination with
hydraulic fluid and subsequent engine failure.
(b) Design the system to avoid hazards arising from the effects of abnormally high temperatures, which may
occur in the system under fault conditions.
(1) Ref. CS 25.1435(b)(1) Appropriate system parameters may include, but are not limited to, pump
or system temperatures and pressures, system fluid quantities, and any other parameters which give the
pilot indication of the functional level of the hydraulic systems.
(2) Ref. CS 25.1435(b)(2) Compliance may be shown by designing the systems and elements to
sustain the transients without damage or failure, or by providing dampers, pressure relief devices, etc.
(3) Ref. CS 25.1435(b)(3) Harmful or hazardous fluid or vapour concentrations are those that can
cause short term incapacitation of the flight crew or long term health effects to the passengers or crew.
2-F-56
BOOK 2 CS-25
Compliance may be shown by taking design precautions, to minimise the likelihood of releases and, in the
event of a release, to minimise the concentrations. Suitable precautions, based on good engineering
judgement, include separation of air conditioning and hydraulic systems, shut-off capability to hydraulic lines,
reducing the number of joints and elements, shrouding, etc. In case of leakage, sufficient drainage should
be provided.
(4) Ref. CS 25.1435(b)(4) Unless it has been demonstrated that there are no circumstances which
can exist (on the aeroplane) under which the hydraulic fluid can be ignited in any of its physical forms (liquid,
atomised, etc.), the hydraulic fluid should be considered to be flammable.
(5) Ref. CS 25.1435(b)(5) If more than one approved fluid is specified, the term “suitable hydraulic
fluid” is intended to include acceptable mixtures. Typical nameplate marking locations for hydraulic fluid use,
are all hydraulic components having elastomer seals such as cylinders, valves, reservoirs, etc.
(c) Tests
Ref. CS 25.1435(c) Test conditions should be representative of the environment that the element,
subsystem or system may be exposed to in the design flight envelope. This may include loads,
temperature, altitude effects, humidity, and other influences (electrical, pneumatic, etc.). Testing may be
conducted in simulators, or stand-alone rigs, integrated laboratory rigs, or on the aeroplane. The test plan
should describe the objectives and test methods. All interfaces between the aeroplane elements and the
test facilities should be adequately represented.
(1) Ref. CS 25.1435(c)(1) Testing for performance should demonstrate rates and responses
required for proper system operation. Testing for fatigue (the repeated load cycling of an element) and
endurance (the ability of parts moving relative to each other to continue to perform their intended function)
should be sufficient to show that the assumptions used in demonstrating compliance with CS 25.1309 are
correct, but are not necessary to demonstrate aeroplane design life. As part of demonstrating that the
element(s), sub-system(s), or system(s) perform their intended functions, the manufacturer (applicant) may
select procedures and factors of safety identified in accepted manufacturing, national, military, or industry
standards, provided that it can be established that they are suitable for the intended application. Minimum
design factors specified in those standards or the requirements may be used unless more conservative
factors have been agreed with the Agency.
(2) Ref. CS 25.1435(c)(2) The tests should include simulation of hydraulic system failure conditions
in order to investigate the effect(s) of those failures, and to correlate with the failure conditions considered
for demonstrating compliance with CS 25.1309. Relevant failure conditions to
be tested are those, which cannot be shown to be extremely improbable, and have effects assessed to be
major, hazardous, or have significant system interaction or operational implications.
Some parts of the system(s) may need to be separately pressurised to ensure the system is completely
tested. Similarly, it may be permissible that certain parts of the system need not be tested if it can be shown
that they do not constitute a significant part of the system with respect to the evaluation of adequate
clearances or detrimental effects.
2-F-57
CS-25 BOOK 2
AMC 25.1436(b)(3)
Pneumatic Systems
1 In systems in which the air pressure of the supply sources is significantly greater than the system
operating pressure (e.g. an engine bleed-air tapping) due account should be taken of the consequences of
failure of the pressure-regulating device when assessing the strength of the system, downstream of the
device relative to the values of PW , PL and PR.
2 Such devices should be protected as necessary against deleterious effects resulting from the
presence of oil, water or other impurities, which may exist in the system.
AMC 25.1436(c)(2)
Pneumatic Systems
The loads due to vibration and the loads due to temperature effects are those loads, which act upon the
elements of the system due to environmental conditions.
AMC 25.1438
Pressurisation and Low Pressure Pneumatic Systems
1 Strength
1.1 Compliance with CS 25.1309(b) in relation to leakage in ducts and components will be achieved if it
is shown that no hazardous effect will result from any single burst or excessive leakage.
1.2 Each element (ducting and components) of a system, the failure of which is likely to endanger the
aeroplane or its occupants, should satisfy the most critical conditions of Table 1.
TABLE 1
Conditions 1 Conditions 2
1·5 P1 at T 1 3·0 P1 at T1
1·33 P2 at T2 2·66 P2 at T2
1·0 P3 at T 3 2·0 P3 at T3
– 1·0 P4 at T4
2-F-58
BOOK 2 CS-25
1.3 After being subjected to the conditions given in column 1 of Table 1, and on normal operating
conditions being restored, the element should operate normally and there should be no detrimental
permanent distortion.
1.4 The element should be capable of withstanding the conditions given in column 2 of Table 1 without
bursting or excessive leakage. On normal operating conditions being restored, correct functioning of the
element is not required.
1.5 The element should be capable of withstanding, simultaneously with the loads resulting from the
temperatures and pressures given in the Table, the loads resulting from –
a. Any distortion between each element of the system and its supporting structures.
b. Environmental conditions such as vibration, acceleration and deformation.
1.6 The system should be designed to have sufficient strength to withstand the handling likely to occur
in operation (including maintenance operations).
2 Tests
2.1 Static tests. Each element examined under 1.2 should be static-tested to show that it can withstand
the most severe conditions derived from consideration of the temperatures and pressures given in the Table.
In addition, when necessary, sub-systems should be tested to the most severe conditions of 1.2 and 1.5.
The test facility should be as representative as possible of the aircraft installation in respect of these
conditions.
2.2 Endurance tests. When failures can result in hazardous conditions, elements and/or sub-systems
should be fatigue-tested under representative operating conditions that simulate complete flights to establish
their lives.
AMC 25.1439(b)(5)
Protective Breathing Equipment
1 If a demand system is used, a supply of 300 litres of free oxygen at 21°C (70°F) and 760 mm Hg
pressure is considered to be of 15 minutes duration at the prescribed altitude and minute volume.
2 Any other system such as a continuous flow system is acceptable provided that it does not result in
any significant increase in the oxygen content of the local ambient atmosphere above that which would result
from the use of a demand oxygen system.
3 A system with safety over-pressure would be an acceptable means of preventing leakage.
4 A continuous flow system of the closed circuit rebreather type is an acceptable system.
AMC 25.1441(d)
Oxygen Equipment and Supply
In assessing the required oxygen flow rates and equipment performance standards, consideration should be
given to the most critical cabin altitude/time-history following any failure, not shown to be Extremely
Improbable, which will result in the loss of cabin pressure taking into account the associated emergency
procedures.
AMC 25.1447(c)
Equipment Standards for Oxygen Dispensing Units
Where Operational Regulations do not require all passengers to be provided with oxygen, (c)(3) and (c)(4)
may not apply.
2-F-59
CS-25 BOOK 2
AMC 25.1447(c)(1)
Equipment Standards for Oxygen Dispensing Units
1 When oxygen masks are presented, oxygen should be supplied to the mask but without flow.
2 Oxygen flow from the mask should be initiated automatically on pulling the mask to the face.
3 Facilities for manual presentation by a crewmember should be provided on each dispensing unit.
4 Indication of the operation of the automatic presentation system should be provided at the
appropriate flight-crew station.
5 The design of the automatic presentation system should take into account that when the landing
field altitude is less than 610 m (2000 feet) below the normal preset automatic presentation altitude, the
automatic presentation altitude may be reset to landing field altitude plus 610 m (2000 feet).
AMC 25.1447(c)(2)
Equipment Standards for Oxygen Dispensing Units
Unless it is required that the pilot at the control is wearing his mask and breathing oxygen while the altitude
exceeds 7620 m (25 000 feet), the design of the flight-crew masks and their stowages should be such that
each mask can be placed in position and put into operation in not more than five seconds, one hand only
being used, and will thereafter remain in position, both hands being free.
AMC 25.1447(c)(4)
Equipment Standards for Oxygen Dispensing Units
1 The equipment should be so located as to be within reach of the cabin crewmembers while seated
and restrained at their seat stations.
2 The mask/hose assembly should be already connected to the supply source, and oxygen should be
delivered with no action being required except turning it on and donning the mask.
3 Where a cabin crewmember’s work area is not within easy reach of the equipment provided at his
seat station, an additional unit should be provided at the work area.
AMC 25.1453
Protection of Oxygen Equipment from Rupture
1 Parts of the system subjected to high oxygen pressure should be kept to a minimum and should be
remote from occupied compartments. Where such parts are installed within occupied compartments they
should be adequately protected from accidental damage.
2 Each container, component, pipe and coupling should have sufficient strength to withstand a
pressure equivalent to not less than the maximum working pressure acting on that part of the system when
multiplied by the appropriate Proof and Ultimate factors given in Table 1. The maximum working pressure
includes tolerances of any pressure limiting means and possible pressure variations in the normal operating
modes. Account should also be taken of the effects of temperature up to the maximum anticipated
temperature to which the system may be subjected. Transient or surge pressures need not be considered
except where these exceed the maximum working pressure multiplied by 1·10.
2-F-60
BOOK 2 CS-25
TABLE 1
3 Each source should be provided with a protective device (e.g. rupture disc). Such devices should
prevent the pressure from exceeding the maximum working pressure multiplied by 1·5.
4 Pressure limiting devices (e.g. relief valves), provided to protect parts of the system from excessive
pressure, should prevent the pressures from exceeding the applicable maximum working pressure multiplied
by 1·33 in the event of malfunction of the normal pressure controlling means (e.g. pressure reducing valve).
5 The discharge from each protective device and pressure limiting device should be vented overboard
in such a manner as to preclude blockage by ice or contamination, unless it can be shown that no hazard
exists by its discharge within the compartment in which it is installed. In assessing whether such hazard
exists consideration should be given to the quantity and discharge rate of the oxygen released, the volume
of the compartment into which it is discharging, the rate of ventilation within the compartment and the fire
risk due to the installation of any potentially flammable fluid systems within the compartment.
6 In addition to meeting the requirements of CS 25.1453, oxygen containers may have to be approved
in accordance with national regulations.
NOTES:
1 The proof pressure should not cause any leakage or permanent distortion.
2 The ultimate pressure should not cause rupture but may entail some distortion.
AMC 25.1457
Cockpit Voice Recorders
In showing compliance with CS 25.1457, the applicant should take account of EUROCAE document No. ED-
56 ‘Minimum Operational Performance Requirement for Cockpit Voice Recorder System’, which will be
referred to in a TSO when published.
AMC 25.1459(a)(4)
Flight Recorders
An acceptable means of compliance would be to provide a combination of system monitors and built-in test
functions, which would detect and indicate the following:
a. Loss of electrical power to the flight recorder system.
b. Failure of the data acquisition and processing stages.
2-F-61
CS-25 BOOK 2
AMC 25.1459(b)
Flight Recorders
1 The phrase ‘as far aft as practicable’ should be interpreted as a position sufficiently aft as to be
consistent with reasonable maintenance access and in a position to minimise the probability of damage from
crash impact and subsequent fire.
2 The container should remain attached to the local structure under normal, longitudinal and
transverse accelerations of at least 10 g.
2-F-62
BOOK 2 CS-25
AMC – SUBPART G
AMC 25.1501
Operating Limitations and Information – General
The limitations and information established in accordance with Subpart G should be only those which
are within the competence of the flight crew to observe, and should relate only to those situations
(including pre- and post-flight) with which a flight crew member might reasonably be concerned.
AMC 25.1519
Weight, Centre of Gravity and Weight Distribution
A statement of the maximum certificated take-off and landing weights, and the minimum certificated
take-off and landing weights, should be established, together with the maximum ramp or taxying
weight, the maximum zero-fuel weight and any other fixed limit on weight, including weight limitations
resulting from such factors as brake energy limits, tyre limits, etc., established in accordance with the
airworthiness standards of CS-25. Any limitations on aeroplane loading associated with the stated
weight limitations (e.g. fuel load and usage, maximum fuel for landing) should be considered.
AMC 25.1521
Power-Plant Limitations
1 In furnishing limitations, consideration should be given to the following. The list does not
necessarily include all the items to be considered for a given aeroplane.
a. Rotational speeds.
f. Anti-icing.
2 Other parameters, e.g. time, altitude, ambient temperatures, airspeed, may be necessary in
defining power-plant limitations.
AMC 25.1523
Minimum Flight Crew
1 Both the number and identity of the flight crew members should be established.
2 If the minimum flight crew varies with the kinds of operation to which the aeroplane is limited,
the approved number and identity of the flight crew members should be stated for each kind of
operation.
3 If a particular flight crew member's station has to be occupied at all material times, this should
be stated when specifying the minimum flight crew.
2–G–1
CS-25 BOOK 2
AMC 25.1533(a)(3)
Take-off distances on runways with a grooved or porous friction course surface
Runways that have a grooved or porous friction course (PFC) surface can maintain a significantly
higher wheel-braking coefficient of friction when wet than can runways that lack such surface
treatments. Where take-off distance information specifically applicable to such runways has been
established, this higher level of friction has been taken into account in accordance with CS 25.109(d).
It is therefore essential that such information is only approved for use on runways having a grooved or
PFC surface that has been constructed and maintained to acceptable standards. FAA AC 150/5320-
12B ‘Measurement, Construction and Maintenance of Skid-Resistant Airport Paving Surfaces’ provides
guidance on such standards. Where such operational approval has not been obtained, the
performance information applicable to a smooth, hard-surfaced runway must be used.
AMC 25.1541
Markings and Placards – General
Markings or placards should be placed close to or on (as appropriate) the instrument or control with
which they are associated. The terminology and units used should be consistent with those used in
the Flight Manual. The units used for markings and placards should be those that are read on the
relevant associated instrument.
AMC 25.1543
Instrument Markings – General
The markings should be such that the instrument remains easily readable with the minimum of
confusion.
AMC 25.1545
Airspeed Limitation Information
A placard could be used when the speed limitation can be a simple presentation (e.g. an IAS speed up
to a given altitude and an indicated Mach number thereafter). A complex speed limitation should be
presented automatically on the instrument, (e.g. by means of an additional moving pointer).
AMC 25.1549
Powerplant Instruments
1 Powerplant instrument range markings are intended to indicate to flight crew members, at a
glance, that the powerplant operation is being accomplished in a safe or desirable, undesirable but
allowable, or unsafe region. The colour red indicates an unsafe condition which requires immediate
and precise action by the flight crew. The use of multiple red lines should be avoided to minimise
confusion.
a. Red, yellow and green lines. 1.3 mm (0·05 inch) wide and 7.6 mm (0·3 inch) long.
b. Red, yellow and green arcs and areas. 2.5 mm (0·1 inch) wide, length as required.
2–G–2
BOOK 2 CS-25
AMC 25.1557(a)
Baggage and Cargo Compartment and Ballast Location
If baggage, cargo compartment and ballast location limitations are complex and involve, for example,
additional limitations on loading intensity and distribution, it is acceptable to provide a placard making
reference to the appropriate document.
AMC 25.1581
Aeroplane Flight Manual
1 PURPOSE
The primary purpose of the European Aviation Safety Agency (EASA) approved Aeroplane Flight
Manual (AFM) is to provide an authoritative source of information considered to be necessary for safely
operating the aeroplane. This Acceptable Means of Compliance (AMC) identifies the information that
must be provided in the AFM under the airworthiness regulations and provides guidance as to the form
and content of the approved portion of an AFM. Although mandatory terms such as ‘shall’ or ‘must’ are
used in this AMC, because the AMC method of compliance is not mandatory, these terms apply only to
applicants who seek to demonstrate compliance by following the specific procedures described in this
AMC.
Paragraphs 25.1581, 25.1583, 25.1585, 25.1587 and 251591 of the CS and noise regulations identify
the information that must be provided in the AFM. Paragraph 25.1581 also requires ‘other information
that is necessary for safe operation because of the design, operating, or handling characteristics’.
Additional related requirements are the applicable operational rules.
3 DEFINITIONS
a. Aeroplane Flight Manual (AFM). A EASA approved document that contains information
(limitations, operating procedures, performance information, etc.) necessary to operate the aeroplane
at the level of safety established by the aeroplane’s certification basis.
c. Safe Operation. For the purposes of this AMC, safe operation means operation of the
aeroplane in a manner that is mandatory, or is recommended, for compliance with the airworthiness
requirements.
d. Limitation. For the purposes of this AMC, an AFM limitation establishes the approved bounds
of operation of the aeroplane or its systems.
e. Aeroplane Flight Manual Warnings, Cautions and Notes. The AFM contains operating
procedures, techniques, etc. that may be categorised as warnings, cautions and notes as defined in
the following paragraphs. The following definitions should not be confused with the colour requirements
prescribed in CS 25.1322 for warning, caution and advisory lights installed in the cockpit.
(1) Warning. An operating procedure, technique, etc. that may result in personal injury or loss of
life if not followed.
(2) Caution. An operating procedure, technique, etc. that may result in damage to equipment if not
followed.
2–G–3
CS-25 BOOK 2
(3) Note. An operating procedure, technique, etc. considered essential to emphasise. Information
contained in notes may also be safety related.
(1) Emergency. A procedure requiring immediate flight crew action to protect the aeroplane and
occupants from serious harm.
(2) Abnormal or Non-normal. A procedure requiring flight crew action, due to failure of a system or
component, to maintain an acceptable level of airworthiness for continued safe flight and landing.
(3) Normal. A procedure associated with systems that are functioning in their usual manner.
g. Revision. A change to the content of the AFM through the addition, deletion, or modification of
material.
h. Appendices and Supplements. Additions to the AFM that may or may not supersede existing
AFM material.
(1) Appendix. An addition to the AFM to cover the installation of optional equipment or specific
operations (engine inoperative ferry, reduced thrust or power takeoff, configuration deviation list (CDL),
etc.).
(2) Supplement. Information that supersedes or is in addition to the basic AFM resulting from the
issuance of a supplemental type certificate (STC), or from approved changes to AFM limitations,
procedures, or performance information without an STC.
4 DISCUSSION
The AFM provides information to safely operate the aeroplane under normal, abnormal and emergency
conditions. The AFM contains the operating limitations, operating procedures, and performance
information for the aeroplane.
a. Historically, the AFM was often the only source of information available to the flight crew for
safely operating a transport category aeroplane. Consequently, the form and content of these earlier
AFMs were designed to meet the needs of the flight crew. For example, very detailed operating
procedures were presented in a form easily used in the cockpit (e.g., checklist format).
b. As more complex equipment was incorporated into transport category aeroplanes, many
aeroplane and equipment manufacturers developed separate operating manuals intended for on-board
use by the flight crew. These operating manuals are generically referred to within this AMC as Flight
Crew Operating Manuals (FCOM). By locating information such as cockpit checklists, systems
descriptions and detailed procedures in the FCOM, the bulk and complexity of the AFM can be kept
manageable. As a result, the AFM for many transport aeroplanes has evolved into more of a reference
document than a document used frequently by the flight crew. In recognition of the usefulness and
convenience provided by these FCOMs, the normal operating procedures information in the AFMs for
these transport category aeroplanes should be limited to those procedures considered ‘peculiar’ to the
operation of that aeroplane type.
c. The AFM should be limited to the smallest practicable amount of material that is appropriate
for the intended operation of the aeroplane. In general, the systems descriptions and procedures
provided in the AFM for most large transport aeroplanes should be limited to that which is uniquely
related to aeroplane safety or airworthiness. Since the AFM still serves as the sole operating manual
for many small transport category aeroplanes, these AFMs should continue to contain detailed
operating information.
2–G–4
BOOK 2 CS-25
d. Widespread use of computers has led to the capability of replacing or supplementing parts of
the conventional paper AFM with a computerized version. Guidance for EASA approval of
computerized AFM information is presented in Appendix 1 of this AMC.
5 GENERAL GUIDELINES
Previously approved AFMs are unaffected by this AMC. When such manuals are amended, the
concepts of this AMC should be applied, if practicable.
a. Segregation of Approved and Unapproved Material. Paragraph 25.1581 of the CS requires that
EASA approved information be segregated, identified, and clearly distinguished from each unapproved
part of the AFM. Unapproved material should be labelled that it is for guidance information only, and
must be located in a different section than the approved material.
(1) Each page of the approved portion should bear the notation, ‘ EASA Approved’, a unique date
of approval or revision number for that page, the aeroplane type or model designation, and an
appropriate document identification number. For AFM pages produced by an STC applicant, both the
STC applicant’s name and the aeroplane type or model designation should appear.
(2) All AFMs, revisions, appendices, and supplements requiring EASA approval must be submitted
to the EASA. A log of currently approved pages in the AFM should be furnished in each copy of the
manual. A location should be provided on the log for the approval signature and the approval date.
Alternatively, a specific approval page can be furnished for the approval signature and the current
revision status.
(3) When revisions are incorporated, a means of indicating those parts of the information that
have been changed should be provided. For example, vertical bars placed in the margin of the revised
page may be used for this purpose. Each revised page should be identified in the same manner as the
original, with the exception of the new date and revision notation, as applicable.
(4) Appendices and supplements should be incorporated in the AFM in a separate section
appropriately identified at the end of the basic manual. Supplements should normally follow
appendices. Format, page identification, organisation, and other details should be the same as that of
the basic manual.
(5) Appendices and supplements may be developed by the TC holder, STC applicant, or the
operator, and should be submitted for evaluation and approval according to EASA certification
procedures. Usually, the TC holder writes appendices to the AFM, and an STC applicant or operator
supplements the AFM. However, an STC applicant may elect to produce a completely new AFM.
(6) It may be necessary to provide a greater amount of descriptive and procedural information in
appendices and supplements than that appearing in the basic AFM, if the appendix or supplement is
the only source for this information.
c. The AFM may address either a single aeroplane model (i.e., hardware build) or several models
of the same aeroplane type. If information is provided for more than one model, the AFM should clearly
identify which operating limitations, operating procedures, and performance information apply to each
model (e.g., by model designation, serial number, etc.). If the AFM format is such that different pages
apply to different aeroplanes, the log of pages should clearly identify the specific pages of the AFM that
apply to each aeroplane.
d. Any required weight and balance information that is not a physical part of the AFM, must be
incorporated by reference in the Limitations Section of the AFM per CS 25.1583(c) and AMC
25.1583(c).
2–G–5
CS-25 BOOK 2
e. Aeroplane Flight Manual Units. The AFM units should be consistent with the flight deck
instrumentation, placards, and other measuring devices for a particular aeroplane. The AFM should be
given in SI units (International System of Units). This does not apply to the units of measurement
related to:
– airspeed : knots.
– altitude : feet.
– vertical speed : feet per minute.
– navigational distance : nautical miles.
Systems of units must be properly identified and presented. Multiple scales may be used on AFM
charts to show different units, e.g., pounds and kilograms. However, the charts should be constructed
to minimise any misunderstanding or interpolation problems by, for example, using a transfer scale so
that principal values of each of the units are on major grid lines or index marks.
The AFM should be divided into the following sections, as appropriate for the specific aeroplane type
or model. For purposes of standardisation, it is recommended that the sequence of sections and of
items within sections follow this outline.
a. Introductory Section. The intent of the introductory material is to identify the revision status
and control the applicability and content of the AFM. The normal content of this section is as follows:
(1) Title page. The title page should include the manufacturer’s name, the aeroplane model
designation, the commercial designation or name, if any, assigned to the aeroplane, and an
appropriate document identification number. Provision should be made for the inclusion of the approval
date of the basic document and the signature, name, and title of the EASA approving official.
(4) Log of pages (including all information necessary to determine which pages apply to a given
aeroplane model (i.e., hardware build)).
(5) Compatibility listing of appendices and supplements produced by the aeroplane manufacturer.
(6) Table of contents. (Alternatively, a table of contents for each section may be placed at the
beginning of that section.)
b. Limitations Section. The purpose of the Limitations Section is to present those operating
limitations appropriate to the aeroplane model as established in the course of the type certification
process in determining compliance with the applicable certification requirements (e.g., CS–25 and
noise regulations). The operating limitations must be expressed in mandatory, not permissive,
language. The terminology used in the AFM must be consistent with the relevant regulatory language.
Limitations prescribed by operating rules may be incorporated as appropriate.
(1) Weight Limitations. A statement of the maximum certificated take-off and landing weights must
be provided. The maximum taxi/ramp weight, maximum zero-fuel weight, and any other fixed limit on
weight, should also be included. Any limitations on aeroplane loading associated with the stated weight
limitations must be included in the AFM or addressed in a separate weight and balance document.
Separate take-off and landing weight limits may be listed corresponding to each applicable constraint
(e.g., structural or noise requirements, customer option, etc.), if the instructions in the Limitations
Section clearly state that the most restrictive of these take-off and landing weight limitations represent
the maximum certified weights.
2–G–6
BOOK 2 CS-25
(i) For those performance weight limits that vary with runway length, altitude, temperature and
other variables, the variation in weight limitations may be presented as graphs in the Performance
Section of the AFM and included as limitations by specific reference in the Limitations Section.
(ii) Only one set of noise limited take-off and landing weights may be established for a specific
aeroplane model (i.e., hardware build).
(2) Noise limitations. An aeroplane model (i.e., hardware build) may not be identified as
complying with the requirements of more than one noise stage level at a time. The operating limitations
contained in the Limitations Section of the AFM should comply with the noise certification criteria for
that stage. If the noise certification status of an aeroplane model is upgraded to a more stringent stage
level the AFM must either be revised or supplemented, whichever is appropriate, to include only
information appropriate to the new stage level.
(i) Landing Flap Restriction. An operating limitation preventing the use of an approved landing
flap setting to comply with noise requirements can only be established under the airworthiness
requirements or as a voluntary design change. A statement must be added to the Limitations Section
to preclude using that landing flap setting for normal operations. Emergency procedures may, however,
continue to use the restricted flap setting. A placard must be placed in the aeroplane and appropriate
other means must be installed (e.g., crushable guard on the restricted portion of the flap selection
quadrant), to prevent using the restricted flap setting for normal operations.
(ii) Reduced and Derated Take-off Thrust or Power. Noise certification levels are determined at
the maximum all-engines operating take-off thrust or power. Reduced and derated thrust or power are
not changes that would invalidate the noise certification status of the aeroplane, provided the full rated
take-off thrust or power remains approved for that aeroplane.
(3) Operating Limitations. The extremes of the operational variables, including any appropriate
descriptions for which compliance with the certification requirements has been shown and for which the
AFM data have been approved, should be listed with respect to the following:
(i) Operations.
(C) Minimum and maximum pressure altitude for which operation is limited for each flight
phase (take-off, en route and landing). Further altitude limitations caused by changes to
structure, powerplant, equipment characteristics or flight characteristics (e.g. due to failures)
should be provided.
(E) Minimum control speed. (This information may be located in the Performance Section
of the AFM, with cross-reference in the Limitations Section.)
(F) Maximum tailwind. The maximum allowable tailwind component for take-off and
landing should normally be limited to 10 knots. If airworthiness approval has been granted for
take-off and landing in tailwinds greater than 10 knots, the AFM should provide the limiting
tailwind value, accompanied by a statement such as the following:
The capability of this aeroplane has been satisfactorily demonstrated for take-off and
manual landing with tailwinds up to knots. This finding does not constitute
operational approval to conduct take-offs or landings with tailwind components greater
than 10 knots.
2–G–7
CS-25 BOOK 2
(1) If the maximum demonstrated crosswind is considered to be limiting for either take-off
or landing, the crosswind limitation must be stated in the Limitations Section. If the crosswind
value is considered to be limiting for one type of operation (e.g. autoland) but not for another,
the crosswind limitation may also state the specific operations to which it applies.
(H) Runway slope. Limitations and performance information should normally be restricted
to runway gradients up to ±2 percent. Limitations for runway slopes greater than ±2 percent
may be approved if the effects of the larger slopes are validated in a manner acceptable to the
EASA.
(I) Runway surface type (smooth and hard-surfaced, or any other type approved).
(C) In accordance with CS 25.123(a), en route flight path data must be presented in the
AFM for all altitudes and temperatures within the operating envelope limits of the aeroplane.
(4) Centre-of-Gravity Limits. Indicate by using tables or graphs the centre of gravity (c.g.) limits for
taxi, take-off and landing, zero fuel weight, and for any other practicably separable flight condition. As
appropriate, data should be provided for a range of weights between the maximum taxi weight and the
minimum in-flight weight. The data should be shown with the appropriate gear position for the phase of
flight, and gear effects on the centre-of-gravity should be built into the charts. Data may be presented
for gear-extended position only if there is proper accounting for the moment change due to gear
retraction. The c.g. limits should be presented in terms of either the distance-from-a specified datum or
as a percentage of the mean aerodynamic chord (MAC). Either the location of the datum or the length
and location of the MAC should be stated, as applicable. If alternate forward c.g. limits have been
approved, these limits should be presented and appropriately identified.
(5) Fuel Limitations. A statement in accordance with CS 25.1585(d) must be included. Operating
limitations due to fuel related considerations (e.g. lateral fuel imbalance, fuel management, fuel
temperature) and their effects on altitude limitations (e.g. boost pump(s) inoperative, fuel type) should
also be provided.
(i) State all limitations necessary to ensure safe operation of engines, propellers, fuel systems
and powerplant accessories, including auxiliary powerplants (see CS 25.1521 and 25A1521 ). If the
use of reduced or derated take-off thrust or power is requested, then any associated operating or
performance limitations should be included in accordance with acceptable reduced and derated take-
off thrust or power procedures. Limitations related to the use of reverse thrust in flight or on the ground
should be clearly identified. Any engine limitations associated with operations in adverse weather
(heavy rain, hail, turbulence, lightning, etc.) should be specified. Any icing conditions that may impact
the normal operation of the engine should also be defined.
(ii) Because engine ice protection is critical to safety in icing conditions, a statement should be
included in the Limitations Section that the engine ice protection must be on during all ground and flight
operations when icing conditions exist or are anticipated. The following definition of icing conditions
should also be included in the Limitations Section:
2–G–8
BOOK 2 CS-25
Icing conditions – Icing conditions exist when outside air temperature (OAT) on the ground and
for take-off, or total air temperature (TAT) in flight, is 10 degrees C or below and visible
moisture in any form is present (such as clouds, fog with visibility of one mile or less, rain,
snow, sleet or ice crystals).
Icing conditions also exist when the OAT on the ground and for take-off is 10 degrees C or
below when operating on ramps, taxiways, or runways where surface snow, ice, standing water
or slush may be ingested by the engines or freeze on engines, nacelles or engine sensor
probes.
(7) Airspeed and Mach Number Limitations. All airspeed limitations should be in terms of indicated
airspeed and in units of knots or Mach number, where applicable and should be consistent with cockpit
indication. If airspeed or Mach number limitations vary with altitude or loading conditions, such
variation must be shown. Limitations data must be included for at least the following:
(i) Maximum operating limit speed, VMO/MMO, together with a statement that this speed limit may
not be deliberately exceeded in any regime of flight (climb, cruise or descent), unless a higher speed is
authorised for flight test or pilot training. The last phrase (unless a higher speed is authorised for flight
test or pilot training) may be omitted at the option of the applicant.
(ii) Manoeuvring speed, VA, together with a statement that full application of longitudinal,
directional and lateral flight controls, as well as manoeuvres that involve angles-of-attack near the stall,
should be confined to speeds below this value.
(iii) Flap-extended speed, VFE, for each approved flap and high lift device position.
(iv) Landing gear operating speed, VLO, together with a statement that this is the maximum speed
at which it is safe to extend or retract the landing gear. If different speeds are established for extension
and retraction, each speed should be listed and defined.
(v) Landing gear extended speed, VLE, together with a statement that this is the maximum speed
at which the aeroplane can be safely flown with the landing gear extended and locked.
(vi) Any other limiting speeds for extendable devices other than the landing gear, should be
included as applicable (e.g. spoilers, thrust reversers, landing lights, ram air turbine (RAT), windows
that may be opened in flight, etc.).
(8) Manoeuvring Load Factor Limitations. The positive and negative flight manoeuvring limit load
factors (expressed in terms of ‘g’s’) for which the structure is approved should be provided, including
any variation with the position of the high lift devices.
(9) Kinds of Operations. This subsection should contain a statement similar to the following:
This aeroplane is certificated as a Large Turbine-powered Aeroplane and is eligible for the
following kinds of operations when the appropriate instruments and equipment required by the
airworthiness and operating requirements are installed and approved and are in operable
condition.
(iv) Day and night operations under visual flight rules (VFR).
2–G–9
CS-25 BOOK 2
(10) Minimum Flight Crew. The minimum number of flight crew approved to operate the aeroplane
should be stated.
(11) Systems and Equipment Limitations. All limitations applicable to systems and equipment
installations that are considered necessary for safe operation must be included. Examples of systems
and equipment installations for which limitations may be appropriate include, but are not limited to,
electrical, hydraulic, pneumatic, cabin pressurisation, air conditioning, airframe fire protection, airframe
ice protection, auto braking systems, autopilot, autothrottle, flight director, yaw damper, anti-skid
devices, performance or flight management system (including software identifier if displayable), etc.
(12) Miscellaneous Limitations. This item should include any information not specified under the
preceding headings but necessary, as a limitation, to ensure safe operation of the aeroplane.
c. Operating Procedures Section. The Operating Procedures Section of the AFM should contain,
as a minimum, the essential information, peculiar to the particular aeroplane type design , that is
needed for safe operation under normal and other-than-normal conditions. Procedures not directly
related to airworthiness, or not under control of the flight crew, should not be included in the AFM. A
notation similar to the following should be placed at the beginning of the Operating Procedures
Section.
The operating procedures contained in this manual have been developed and recommended
by the manufacturer and approved by the EASA for use in operating this aeroplane. These
procedures are provided as guidance and should not be construed as prohibiting the operator
from developing equivalent procedures in accordance with the applicable operating rules.
(1) Procedures Categories. Information should be presented for normal, non-normal, and
emergency procedures and be distinctly separated. Procedural tasks considered to be recall or
immediate action items, which must be accomplished from memory, should be clearly identified.
(2) Format. Procedures should be presented either in a narrative or a checklist format, depending
upon the intended use of the AFM.
(i) Narrative. This format is acceptable if sources of procedures information other than the AFM
are intended for flight crew use (e.g. Flight Crew Operating Manual (FCOM)). Procedures presented in
this format should be drafted in a manner from which the needed sequence can be easily established.
(ii) Checklist. This format should be used if the AFM is intended to be used directly by the flight
crew for operating procedures.
(3) Procedures Development. Prior to initial type certification, it is essential to verify that
proposed procedures are technically valid and operationally practicable. It is recognised that such
procedures may have had only limited operational exposure at the time of certification and may need to
be revised based on service experience.
(4) Procedures Content. The content and level of detail for the normal, non-normal, and
emergency procedures provided in the AFM should be based on the intended use of the AFM. More
information and detail should be provided in AFMs that are intended to be the flight crew’s primary
sources of operating procedures information than for AFMs that are not intended to be used directly by
the flight crew.
2–G–10
BOOK 2 CS-25
(ii) Other Sources of Procedures Information. The flight crew of large transport category
aeroplanes typically use other sources of operating procedures information other than the AFM.
Examples of other sources of operating procedures information include manufacturer- or operator-
produced operating manuals, Quick Reference Handbooks (QRH), System Pilot’s Guides and
Emergency or Abnormal Checklists. For these aeroplanes, items such as cockpit checklists, systems
descriptions, and the associated normal procedures should not be presented in the AFM if they are
provided in other documents acceptable to the Agency. Normal procedures that are necessary for safe
operation should be presented in the AFM, but the remaining normal procedures should be placed in
the manufacturer produced FCOM (or other acceptable sources of operating procedures information).
The non-normal procedures section of the AFM for these types of aeroplanes should include, as a
minimum, procedures dictated by the aeroplane’s system and failure modes, and may also include
those emergency procedures listed in paragraph 6.c(5) of this AMC. Whenever procedures are
provided in another source rather than the AFM, a statement should be placed in the appropriate
procedures section of the AFM referencing where the detailed procedures information can be found.
(iii) AFM Used Directly. For those manufacturers and operators that do not produce other sources
of procedures information (generally manufacturers and operators of small transports), the AFM is the
only source of this information. In this circumstance, the AFM operating procedures information must
be comprehensive and include information such as cockpit checklists, systems descriptions and
associated procedures.
(5) Emergency Procedures. The emergency procedures can be included either in a dedicated
section of the AFM or in the non-normal procedures section. In either case, this section should include
the procedures for handling any situation that is in a category similar to the following:
(iv) Smoke control. The following should be clearly stated in the AFM:
After conducting the fire or smoke procedures, land at the nearest suitable airport, unless it is
visually verified that the fire has been extinguished.
d. Performance Section. This section of the AFM contains the performance limitations, other
data required by the applicable airworthiness and noise regulations, and any special conditions that
may apply. Additional information may be provided to assist the operator in complying with the
operating rules or for implementing unique operational needs. The performance information should
cover the operating range of weights, altitudes, temperatures, aeroplane configurations, thrust ratings,
and any other operational variables stated as operational performance limitations for the aeroplane. If
additional performance information is presented for operation at a specific altitude, these performance
2–G–11
CS-25 BOOK 2
data should cover a pressure altitude span of at least the specific altitude ±1,000 feet to allow an
operator to adequately account for pressure altitude variations. It is recommended that such data be
included as a separate section or appendix to the AFM.
(1) General. Include all descriptive information necessary to identify the configuration and
conditions for which the performance data are applicable. Such information should include the type or
model designations of the aeroplane and its engines, the approved flap settings, a brief description of
aeroplane systems and equipment that affect performance (e.g. anti-skid, automatic spoilers, etc.), and
a statement indicating whether such systems and equipment are operative or inoperative. This section
should also include definitions of terms used in the Performance Section (e.g. IAS, CAS, ISA,
configuration, net flight path, icing conditions, etc.), plus calibration data for airspeed (flight and
ground), Mach number, altimeter, air temperature and other pertinent information. The airspeed,
altitude and air temperature calibration data should be presented for the following ranges:
(A) Airspeed and Altimeter: For the take-off/take-off path altitude range, 1.18 VSR to
VMO/MMO.
(B) Airspeed and Altimeter: For higher altitudes, from 1.18 VSR or the speed for 1·2 g
buffet onset margin, whichever is lower, to VMO/MMO.
(C) Mach Number: From the lowest useful Mach number (generally in the range of 0·4 to
0·5) to MMO.
(D) Total or Static Air Temperature: For Mach numbers corresponding to the speed ranges
noted in paragraphs 6.d(1)(iii)(A) and (B) of this AMC.
(2) Performance Procedures. The procedures, techniques and other conditions associated with the
AFM performance data should be included. Performance procedures may be presented as a
performance subsection or in connection with a particular performance graph. In the latter case, a
comprehensive listing of the conditions associated with the particular performance data may serve as
procedures if sufficiently complete. The AFM should also include adequate information to enable the
operator to show compliance with CS 25.1001 for each take-off.
(3) Thrust or Power Setting. Thrust or power settings should be provided for at least take-off,
maximum continuous, and go-around thrust or power, along with the thrust or power setting procedures
necessary to obtain the performance shown in the AFM. These data should be shown for each
applicable thrust or power setting parameter. If backing the aeroplane by reverse thrust is proposed,
thrust setting limits should be established considering contaminated runway, foreign object damage
potential, environmental control system impact, aeroplane weight and c.g., cockpit visibility, effect of
braking, etc.
(4) Minimum Control Speeds. Minimum control speed data may be located in the Performance
Section with a reference in the Limitations Section as to its location.
2–G–12
BOOK 2 CS-25
(5) Stall Speeds. The stall speeds established in showing compliance with certification
requirements should be presented, together with associated conditions. Data should be presented in
terms of calibrated airspeed. If applicable, stall speed increments with accreted ice must be provided.
(6) Take-off Speeds. The take-off speeds, V1, VR and V2 must be presented in the AFM, together
with the associated conditions. These speeds should be presented in units consistent with cockpit
instrument indication. V1 and VR speeds should be based upon ground effect calibration data while V2
speeds should be based upon free air calibration data. The take-off speeds associated with minimum
control speeds and the maximum energy absorption capability of the brakes should be included. At the
option of the applicant, the AFM may also include the V1 speeds associated with unbalanced field
lengths. At all conditions and aeroplane configurations represented in the AFM (i.e., at all altitudes,
temperatures, weights, winds, runway slopes, flap settings, etc.), the accuracy of the V1 speed should
either 1) be within 1·5 knots of the V1 speed used to calculate the take-off and accelerate-stop
distances, or 2) not cause an increase to these distances of more than the greater of 100 feet or the
incremental increase resulting from a 1·5 knots variation in V1 speed.
(7) Take-off and Accelerate-Stop Distances. Take-off and accelerate-stop distances, complying
with CS 25.105, 25.109, 25.113, and 25.1591 must be provided. At the option of the applicant, and with
concurrence by the Agency, additional data may be provided for operations on other than smooth hard-
surfaced runways.
(8) Climb Limited Take-off Weight. The climb limited take-off weight, which is the most limiting
weight showing compliance with CS 25.121(a), (b) and (c), must be provided.
(9) Miscellaneous Take-off Weight Limits. Take-off weight limits should be shown for any
equipment or characteristic of the aeroplane that imposes an additional take-off weight restriction (e.g.
maximum tyre speed, maximum brake energy, fuel jettison consideration, inoperative system(s), etc.).
(10) Take-off Climb Performance. For the prescribed take-off climb aeroplane configurations, the
climb gradients must be presented, together with associated conditions. The scheduled climb speed(s)
should be included.
(11) Take-off Flight Path Data. Take-off flight paths, or performance information necessary to
construct such paths, together with the associated conditions (e.g. procedures and speeds), should be
presented for each approved take-off configuration. The presentation should include all flight path
segments existing between the end of the take-off distance and the end of the take-off path, as defined
in CS 25.111(a). Such data must be based upon net performance, as prescribed in CS 25.115(b) and
(c).
(12) En route Flight Path Data. The net flight path gradient data prescribed in CS 25.123 must be
presented, together with the associated conditions (e.g. procedures and speeds). Data must be
presented for one- and two-engine-inoperative cases, as applicable, throughout the approved
operating altitude and temperature envelope.
(13) Climb Limited Landing Weight. The climb limiting landing weight, which is the most limiting
weight showing compliance with CS 25.119 and 25.121(d), should be provided.
(14) Miscellaneous Landing Weight Limits. Landing weight limits for any equipment or characteristic
of the aeroplane configuration that imposes an additional landing weight restriction should be shown.
(15) Approach Climb Performance. For the approach climb configuration, the climb gradients (CS
25.121(d)) and weights up to maximum take-off weight (CS 25.1587(b)(3)) should be presented,
together with associated conditions (e.g. procedures and speeds). The effects of ice accretion on
unprotected portions of the airframe and the effects of engine and wing ice protection systems should
be provided.
(16) Landing Climb Performance. Data for the landing climb configuration should be presented in a
manner similar to that described for the approach configuration above.
2–G–13
CS-25 BOOK 2
(17) Landing Approach Speeds. The scheduled speeds associated with the approved landing
distances and operational landing runway lengths (see paragraph 6.d(18) of this AMC) should be
presented, together with associated conditions.
(18) Landing Distance. The landing distance from a height of 50 ft must be presented either
directly or with the factors required by the operating regulations, together with associated conditions
and weights up to the maximum take-off weight. For all landplanes, landing distance data must be
presented for smooth, dry, hard-surfaced runways for standard day temperatures. With concurrence by
the Agency, additional data may be presented for other temperatures and runway slopes within the
operational limits of the aeroplane, or for operations on other than smooth, hard-surfaced runways. For
all weather operations, additional landing performance data may be required.
(19) Performance Limits and Information Variation with Centre of Gravity. If performance
information, (e.g. buffet boundary) is not presented for the most critical c.g. condition, the AFM should
present the effect of variation with c.g.
(20) Noise Data. The noise levels achieved during type certification in accordance with the
applicable noise requirements should be presented, together with associated conditions and with the
following note:
No determination has been made by the EASA that the noise levels of this aircraft are or
should be acceptable or unacceptable for operation at, into or out of any airport.
The noise levels achieved during type certification should be included in the AFM and consist of only
one take-off, one sideline, and one approach noise level for each aeroplane model (i.e. hardware
build). The noise certification standard complied with should accompany the noise level information to
indicate the compliance status. Supplementary information (labeled as such) may be added to the AFM
concerning noise levels for other configurations or conditions.
(21) Miscellaneous Performance Data. Any performance information or data not covered in the
previous items that are required for safe operation because of unusual design features or operating or
handling characteristics should be furnished. For example, the maximum quick turn around weight
should be provided.
(1) Loading Instructions Presented in a Separate Document. If the loading instructions are
presented in a separate document, the AFM Limitations Section should contain at least the following:
(vii) Information required to maintain the aeroplane within the above limits.
2–G–14
BOOK 2 CS-25
(i) Weight Limits. A list and identification of all weight limitations should be included.
(iii) Dimensions, Datum and MAC. The dimensions and relative location of aeroplane features
associated with weighing and loading of the aeroplane and with weight-and-balance computations
should be described or illustrated.
(iv) Configuration Checklist or Equipment List. The aeroplane should be defined or described
sufficiently to identify the presence or absence of optional systems, features or installations that are
not readily apparent. In addition, all other items of fixed or removable equipment included in the empty
weight should be listed.
(v) Fuel and Other Liquids. All fuel and other liquids, including passenger service liquids, that are
included in the empty weight should be identified and listed, together with the information necessary to
enable ready duplication of the particular condition.
(vi) Weighing Computations. Computation of the empty weight and the empty-weight c.g. location
should be included.
(viii) Loading Instructions. Complete instructions relative to the loading procedure or to the use of
the loading schedule should be included.
Operation of the aeroplane without certain secondary airframe and engines parts is allowed through
the use of an approved CDL. The CDL should be included in the AFM as a separate appendix. The
following guidance should be followed when preparing the CDL.
a. The parts or combinations of parts permitted to be missing, together with the associated
performance penalties and other limitations should be determined and presented in the same format as
the Master Minimum Equipment List (MMEL).
(1) Only a single performance penalty for take-off and a single performance penalty for landing will
be permitted. For take-off, the penalty shall be the most restrictive of the take-off field length, first,
second and final segment climbs, and take-off flight path considerations. For landing, the penalty shall
be the most restrictive of approach climb, landing climb, and landing distance considerations.
2–G–15
CS-25 BOOK 2
(2) Only a single weight penalty for en route climb performance, applying to both the one-engine-
inoperative and two-engine-inoperative cases, as applicable, will be permitted.
(3) The CDL should contain the explanations of take-off performance penalty, landing
performance penalty and en route performance penalty, as appropriate for the aeroplane, when
individual penalties are used.
d. General Limitations. The following information should be presented in the CDL appendix:
(1) When the aeroplane is operated using the CDL, it must be operated in accordance with the
limitations specified in the AFM, as amended in the CDL.
(2) The associated limitations must be listed on a placard affixed in the cockpit in clear view of the
pilot in command and other appropriate crew member(s).
(3) The pilot in command should be notified of each operation with a missing part(s) by listing the
missing part(s) in the flight or dispatch release.
(4) The operator should list in the aeroplane logbook an appropriate notation covering the missing
part(s) on each flight.
(5) If an additional part is lost in flight, the aeroplane may not depart the airport at which it landed
following this event, until it again complies with the limitations of the CDL. This, of course, does not
preclude the issuance of a ferry permit to allow the aeroplane to be flown to a point where the
necessary repairs or replacements can be made.
(6) No more than one part for any one system may be missing, unless specific combinations are
indicated in the CDL. Unless otherwise specified, parts from different systems may be missing. The
performance penalties are cumulative, unless specifically designated penalties are indicated for the
combination of missing parts.
(7) No more than three parts that have each been determined to cause a negligible performance
degradation may be missing for take-off without applying a performance penalty. When more than
three such parts are missing, a performance penalty of either 0·05 percent of the maximum take-off
weight or 50 kg, whichever is less, must be applied for take-off, en route, and landing for each missing
part.
(8) Take-off performance penalties should be applied to the take-off weights that are limited by
performance considerations (i.e. take-off field length, first, second, or, final segment climb, or take-off
flight path). If the performance limited take-off weight is greater than the maximum certified take-off
weight, the take-off performance penalties should be applied to the maximum certified take-off weight
to ensure compliance with the noise requirements.
(9) Landing performance penalties should be applied to the landing weights that are limited by
performance considerations (i.e. landing field length, landing climb or approach climb). If the
performance limited landing weight is greater than the maximum certified landing weight, the landing
performance penalties should be applied to the maximum certified landing weight to ensure compliance
with the noise requirements.
(10) En route performance penalties apply only to operations that are limited by the one- or two-
engine(s) inoperative en route climb performance.
(11) The numbering and designation of systems in the CDL appendix is based on Air Transport
Association (ATA) Specification 100. The parts within each system are identified by functional
description and, when necessary, by part numbers.
2–G–16
BOOK 2 CS-25
a. General. Whenever a minor change to the type design aerodynamic configuration or a CDL
proposal (e.g. installation of wing tip mounted emblem lights, missing flap hinge covers, etc.), has been
submitted for EASA approval, the applicable performance degradation needs to be determined. In lieu
of a complete flight test analysis to determine the performance degradation, simple criteria are
prescribed below for establishing an acceptable level of airworthiness for the affected items.
b. Criteria.
(1) Estimated Drag. The aerodynamic drag of the type design change or CDL item should be
evaluated. Design changes or CDL items that have no impact on, or actually improve, the aerodynamic
drag of the aeroplane are considered to have no performance penalty. In cases where there are
quantifiable effects on aerodynamic drag (no matter how small), the drag value should be estimated
and then increased by a factor of 2, unless the estimate drag was determined with equivalent
conservatism.
1 PURPOSE
This appendix presents guidelines for obtaining approval of a computerised version of an AFM that
would replace or supplement parts of the conventional paper AFM. These guidelines also apply to
computerised AFM appendices and supplements. The criteria provided in the main body of this AMC
remain applicable except where modified by this appendix. These guidelines do not cover:
c. Supplementary software or software functions used to prepare documentation suitable for use
in the operation of the aeroplane under the applicable operating rules (e.g. airport analysis software).
2 APPLICABILITY
This appendix applies to aeroplanes eligible to be certificated to CS 25. The guidelines contained
herein pertain to generating and presenting AFM performance information required by CS 25 by means
of computer software. This appendix may be amended to include relevant aspects for other EASA
approved information that is stored and presented through computer software.
3 DEFINITIONS
a. Computerised AFM. The computerised AFM software application used in conjunction with the
hardware and software environment in which it is installed to generate computerised AFM information.
b. Computerised AFM Software Application. The computer programs and data, installation
information and operating guide that are used in generating computerised AFM information.
2–G–17
CS-25 BOOK 2
d. Software Environment. The additional computer programs (e.g. operating system) that provide
services to the computerised AFM software application to input, process and output the information to
the user.
e. Hardware Environment. The equipment (e.g. terminal, printer, keyboard, math co-processor,
central processing unit, etc.) that enables the operation of the software environment and the
computerised AFM software application to input, process and output the information to the user.
h. First Principles Calculation. A Calculation using basic parameters such as lift, drag, thrust,
etc. with the equations of motion.
4 GENERAL GUIDELINES
The criteria herein do not affect the status of computerised AFMs that have previously been EASA or
JAA approved. When such manuals are amended in the future, the concepts of this appendix should
be applied, where practicable.
a. Official Reference
(1) The conventional paper portion of the AFM should contain appropriate references about
applicability of the EASA approved computerised AFM software application. This reference should be
revised each time the EASA approved computerised AFM software application is changed (see
paragraph 6.d of this appendix).
The computerised AFM replaces or supplements portions of the paper AFM, and is an EASA
approved source for that AFM information. Any modification to the EASA approved
computerised AFM software application, or subsequent alteration to the generated output, will
cancel the airworthiness approval of the information, unless this change was approved by the
EASA. This statement applies regardless of any approval notation printed on a generated
output.
b. Approved and Unapproved Information. Paragraph 25.1581 of the CS requires that the EASA
approved information be segregated, identified and clearly distinguished from any unapproved
information in the AFM. Therefore, the approval status of generated output should be clearly indicated
on the screen and printed on each printout page of any calculated results by indication of:
(3) Approval status of results with respect to requirement basis of the computation (e.g.
FAR/Certification Specifications (CS)).
(4) Applicable certification basis, if the program is capable of generating results for more than one
certification basis (e.g. FAR/Certification Specifications (CS)).
2–G–18
BOOK 2 CS-25
c. Software Usage Aspects. The applicant should substantiate that the computerised AFM is
designed to:
(1) Provide a generated output containing all the information required to be in the conventional
paper AFM by CS 25 for the part that is replaced or supplemented by the computerised AFM. This
includes all relevant information (e.g. variables used for a specific condition) to determine operating
condition and applicability of the generated output.
(2) Provide equivalent or conservative results to that obtained by direct use of a first principles
calculation using certified baseline parameters (e.g. lift, drag, thrust).
(3) Preclude calculations that would generate results identified as EASA approved by:
(i) Extrapolating data beyond computational bounds agreed to by the Agency and the applicant;
or
(4) Provide at least the standard of transparency (e.g. understanding of performance relations and
limitations) that is available from a conventional paper AFM presentation.
(5) Minimise mistakes or misunderstanding by a trained user during data input and interpretation
of output.
a. General
(Reserved.)
b. Limitations Section
(Reserved.)
c. Procedures Sections
(Reserved.)
d. Performance Section
(1) The computerised AFM may be used to generate all of the EASA approved performance
information required to be in the AFM.
(2) The operating rules require operators to carry, in each transport category aeroplane, either
the AFM or an operator-prepared manual that contains all of the information required to be in the AFM.
The computerised AFM is not intended for use on board the aeroplane. Thus, any portions of the AFM
that are provided only in computerised (i.e. electronic) form may not be used to satisfy these operating
requirements. This does not preclude printing out information calculated by the EASA approved
computerised AFM and subsequently using the paper printout on board the aeroplane.
(3) Configuration Deviation List (CDL) and Master Minimum Equipment List (MMEL) effects on
performance may be included if they are EASA approved and applications are clearly identified on the
generated output.
2–G–19
CS-25 BOOK 2
(4) Although the output from the computerised AFM should be usable without adjustment, applying
corrective factors that are provided in the paper AFM may be acceptable in the following cases:
(ii) Urgent temporary EASA approved revisions made mandatory for safety reasons.
(iii) Any case in which the appropriate data are unavailable from the computerised AFM and it is
clear to the user that corrective factors must be applied.
(5) Supplementary performance information may be included in accordance with paragraph 4.b of
this appendix (e.g. for operation on runways contaminated with standing water, slush, snow or ice).
(6) The applicant may request EASA approval of supplementary computerised AFM applications
(e.g. optimised runway performance). This supplementary software application will not be required by
the EASA for type certification.
The computerised AFM consists of the AFM software application used in conjunction with the hardware
and software environment in which it is installed. This paragraph provides guidelines that address the
integrity, development process, and documentation requirements of the software.
a. Software Integrity
(1) The computation of hazardously misleading primary information such as take-off speeds,
landing approach speeds, engine thrust or power, engine limit data or other related aeroplane
performance data, should be improbable (as defined in CS 25.1309). The AFM software application
should , as far as practicable, be protected from inadvertent, deliberate, or unauthorised alterations.
For example, self-check features could be used to provide software verification and protection against
deliberate or inadvertent alteration.
(2) The level of integrity established for the computerised AFM is the basis for the software
development process and should be addressed in the plan for software aspects of certification (see
paragraph 6.b of this appendix).
(3) Each part of the EASA approved AFM software application (e.g. program, data) should bear a
unique notation, a unique date, or a revision number.
(4) A means to check the programs and data to avoid undetected failures should be provided (e.g.
a checksum routine, tabular data to verify a check case, or provisions for a line-by-line file
comparison).
(5) Commercially available software, such as operating systems (e.g. MS-DOS), word-processors
and spreadsheets, will not be approved by the EASA. However, this software can be used to run the
computerised AFM software application or process (i.e. edit, format, manipulate, etc.) AFM data to
produce approved AFM information if:
(i) the applicant demonstrates that the unapproved software does not interfere with the correct
functioning of the EASA approved computerised AFM software application;
(ii) the applicant demonstrates that the unapproved software produces reliable results when used
with the specified hardware environment and the computerised AFM software application; and
(iii) the applicant specifies, in the paper AFM or a user’s guide, the title, manufacturer, and version
number of such software. The version number may refer to future versions of the software (e.g.
2–G–20
BOOK 2 CS-25
‘Version XX and later’) if the verification check performed under paragraph 6.c(1) of this appendix is
designed such that improper operation of these later software versions would be detected.
b. Software Development. The integrity of the software components of the computerised AFM is
achieved through the software development processes used.
(1) The applicant should propose the software development process in the plan for software
aspects of certification. The application should document the methods, parameters and allowable
range of conditions contained in the computerised AFM. The results obtained from the computerised
AFM should be shown to meet all applicable CS 25 requirements. This compliance may be shown
using substantiation documentation, demonstrations, or other means mutually agreed to by the Agency
and the applicant. The software development process described in AC 20-115B (RTCA
DO-178B)/EUROCAE ED-12B) is valid, in general, for developing either airborne or ground based
software. It represents one acceptable approach, but not the only acceptable approach, for developing
software for the computerised AFM. Some of the specific guidance provided in AC 20-115B, however,
may not apply to the computerised AFM.
(2) The applicant should submit a description of the computerised AFM and the plan for software
aspects of certification to the Agency for review early in the certification process. This plan proposes
the schedule and means by which compliance with the requirements will be achieved and the means
by which certification data and supporting records will be made available to the Agency for review.
c. Hardware and Software Environment. The computerised AFM software application may be
EASA approved independent of the hardware and software environment in which it is installed. A
common example of this would be the development of a computerised AFM software application to be
run in a commercial-off-the-shelf (COTS) hardware and software environment. The applicant should
provide for item (1) as follows, plus either item (2) or (3), as appropriate.
(1) A mechanism, such as an installation utility function or test set, that verifies the proper
functioning of the computerised AFM software application in the target software and hardware
environment. The verification check should include, but not be limited to, proper functioning with
hardware specified in the AFM, including input and output devices, and with resident software,
including terminate-to-stay-resident or other control programs such as Microsoft Windows, and with
any operating system calls made by the AFM software.
(2) If the computerised AFM is intended for a COTS hardware and software environment,
installation information that describes the minimum requirements, including limitations and constraints,
for the software and hardware environment.
(3) If the computerised AFM is intended for a specific hardware/software system, installation
information that describes the specific hardware and software environment in which the computerised
AFM software application must be installed. Additionally, the applicant should provide a configuration
management scheme that ensures the hardware and software environment that will be used in service
is identical to the environment specified in the EASA approved installation data.
(1) Revisions to a EASA approved computerised AFM should be submitted for evaluation and
EASA approval in accordance with software development methodology established in paragraph 6.b of
this appendix. A log of EASA approved AFM software application parts should be furnished by the
applicant. For historical purposes, the applicant should maintain records from which the information
from any approved revision level of the computerised AFM can be reproduced, unless none of the
affected aeroplanes remain in operational service.
(2) The applicant should submit a description of the proposed changes and an updated plan for
software aspects of certification. In addition, the applicant should:
2–G–21
CS-25 BOOK 2
(i) re-assess the software integrity level (paragraph 6.a of this appendix) of the revised
computerised AFM;
(ii) demonstrate that revisions do not affect any of the unrevised portions of the computerised
AFM; and
(iii) demonstrate that the revisions are compatible with the hardware and software environment
intended for the computerised AFM software application.
(3) Revisions to a computerised AFM can be made only by the TC or STC holder of that
computerised AFM. The STC applicant may supplement but not revise a TC holder’s computerised
AFM.
(4) When revisions are incorporated, a means (e.g. document) of indicating those parts of the
software that have been changed should be provided.
(5) Each revised software element should be identified in the same manner as the original, with
the exception of the new date or revision notation (see paragraph 6.a(3) of this appendix).
e. Submittal and EASA Approval of Software
(1) The applicant will be considered the responsible party for all matters pertaining to the
computerised AFM software application, including submittal to the Agency and obtaining EASA
approval.
(2) The applicant and the Agency shall discuss and agree on the data structures and calculation
models.
(3) The applicant should provide any part of the hardware environment necessary for operating
the computerised AFM that is not readily available to the Agency.
(1) Approval plan that describes the software aspects of certification, including time schedules, an
outline of the desired applications, and design objectives for software and data integrity.
(2) Software development plan, including the methods used to accomplish the design objectives.
(3) Software descriptions, including justifications that program structures and calculation models
are appropriate to their intended function.
(4) Data verification document, including a description of the scope and depth of the review,
analysis, and tests used to determine that the developed software and generated output accurately
reflect the aeroplane performance characteristics. This description should include the purpose of each
test case and the set of inputs, expected results, test environment and calculated results.
(5) Operating instructions, including all information for proper use of the computerised AFM,
installation instructions, and identification of the suitable hardware and software environment.
(6) Software configuration reference, including a log of the approved software elements and a
statement that design objectives of the approval plan and compliance with the guidelines of this
appendix have been demonstrated.
In the plan for software aspects of certification, the applicant should propose which components of the
computerised AFM will be submitted to the EASA. In cases where the AFM software application can be
2–G–22
BOOK 2 CS-25
installed on EASA equipment, the applicant need only provide the computerised AFM software
application, which includes the installation data and operating guide. However, if the computerised
AFM software application requires a hardware and software environment that is not available to the
EASA, the applicant should also provide the EASA with the necessary components to access the AFM
software application.
1 PURPOSE
This appendix to the AMC 25.1581 is a guideline for preparation of the AFM specification required
early in the certification process to allow judgement about acceptability of various peculiarities of the
proposed flight manual.
2 APPLICABILITY
3 DEFINITIONS Reserved.
4 GENERAL GUIDELINES
a. Constructors Name.
n. Amendment system (e.g. temporary revision identification and normal revision identification).
2–G–23
CS-25 BOOK 2
r. References to other information required by the certification basis but not contained in the
basic AFM.
The document presented may include more than the proposed amount of information, if deemed
necessary.
AMC 25.1583(i)
Manoeuvring Flight Load Factors
The flight manoeuvring limit load factors for which the structure is approved, expressed in terms of
normal acceleration, or g, should be included. If more restrictive flight load factors are established for
particular operations outside the normal operating envelope (e.g. landing flap position with maximum
take-off weight) such factors should be presented and defined.
AMC 25.1583(k)
Maximum Depth of Runway Contaminants for Take-off Operations
NOTE 1 In establishing the maximum depth of runway contaminants it may be necessary to take account of the
maximum depth for which the engine air intakes have been shown to be free of ingesting hazardous quantities of water or
other contaminants in accordance with CS 25.1091(d)(2).
NOTE 2: Unless performance effects are based on tests in water depths exceeding 15 mm, or on other evidence
equivalent in accuracy to the results of direct testing, it will not normally be acceptable to approve take-off operation in
depths of contaminants exceeding the equivalent of 15 mm of water.
2–G–24
BOOK 2 CS–25
AMC – SUBPART J
AMC 25A901(b)(2)
Assembly of Components (Auxiliary Power Units)
The objectives of CS 25.671(b) should be satisfied with respect to APU systems, where the safety of
the aeroplane could otherwise be jeopardised.
AMC 25A901(b)(4)
Electrical Bonding (Auxiliary Power Units)
Where the APU is not in direct electrical contact with its mounting the engine should be electrically
connected to the main earth system by at least two removable primary conductors, one on each side of
the APU.
AMC 25A901(d)
General (Auxiliary Power Units)
The need for additional tests, if any, in hot climatic conditions should take account of any tests made
by the APU constructor to establish APU performance and functioning characteristics and of
satisfactory operating experience of similar power units installed in other types of aeroplane.
The applicant should declare the maximum climatic conditions for which compliance will be established
and this should not be less severe than the ICAO Intercontinental Maximum Standard Climate (38°C
(100°F) ) at sea-level). If the tests are conducted under conditions which deviate from the maximum
declared ambient temperature, the maximum temperature deviation should not normally exceed 14°C
(25°F) .
AMC 25B903(e)(2)
APUs (Auxiliary Power Units)
2.1 Sufficient flight tests should be made over the range of conditions detailed in 2.2 and 2.3 to
establish the envelope of altitude and airspeed for reliable APU restarts, taking into account the results
of restart tests completed by the APU constructor on the same type of APU in an altitude test facility or
flying test bed, if available, and the experience accumulated in other aircraft with the same APU. The
effect of APU deterioration in service should be taken into account.
2.2 Altitude and Configuration. From sea-level to the maximum declared restarting altitude in all
appropriate configurations likely to affect restarting, including the emergency descent configuration.
2.3 Airspeed. From the minimum to the maximum declared airspeed at all altitudes up to the
maximum declared APU restarting altitude. The airspeed range of the declared relight envelope
should cover at least 56 km/h (30 kt).
2.4 Delay Tests. The tests referred to in 2.2 should include the effect on APU restarting
performance of a delay period between APU shut-down and restarting.
2–J–1
CS–25 BOOK 2
AMC 25A939(a)
Turbine APU Operating Characteristics (Auxiliary Power Units)
The wording ‘in flight’ should be interpreted to cover all operating conditions from APU start until shut-
down.
AMC 25A943
APU Operating Characteristics (Auxiliary Power Units)
1 Compliance with CS 25A943 should be shown by design analysis and flight tests. The flight
tests should include manoeuvre in which less than zero ‘g’ occurs for one continuous period of at least
5 seconds and a further manoeuvre with two periods of less than zero ‘g’ with a total time for these two
periods of at least 5 seconds.
AMC 25A953(b)
Fuel System Independence (Auxiliary Power Units)
The fuel supply to an APU may be taken from the fuel supply to the main engine if provision is made
for a shut-off means to isolate the APU fuel line.
AMC 25B961(a)(5)
Fuel System Hot Weather Operation (Auxiliary Power Units)
Subject to agreement with the Agency, fuel with a higher vapour pressure may be used at a
correspondingly lower fuel temperature provided the test conditions closely simulate flight conditions
corresponding to an initial fuel temperature of 43°C (110°F) at sea-level.
AMC 25B991
Fuel Pumps (Auxiliary Power Units)
If the fuel supply to the APU is taken from the fuel supply to the main engine, no separate pumps need
be provided for the APU.
AMC 25B1093(b)(2)
APU Air Intakes (Auxiliary Power Units)
1.1 Method 1. Method 1 is an arbitrary empirical method based on United Kingdom and French
practice. This method is acceptable to the Agency.
1.2 Method 2. Method 2 is a general approach based on US practice in applying FAR Part 25,
Appendix C. If this method is used, each application will have to be evaluated on its merits.
2–J–2
BOOK 2 CS–25
2.2 The intake may be tested with the APU in accordance with the requirements of CS–APU, Book
1, paragraph 5.2 and the Acceptable Means of Compliance for the testing of APUs in Icing Conditions.
2.3 When the intake is assessed separately it should be shown that the effects of intake icing
would not invalidate the icing tests of CS–APU. Factors to be considered in such evaluation are –
b. The shedding into the APU of intake ice of a size greater than the APU is known to be able to
ingest.
c. The icing of any APU sensing devices, other subsidiary intakes or equipment contained within
the intake.
d. The time required to bring the protective system into full operation.
2.4 Tests in Ice-forming Conditions. An acceptable method of showing compliance with the
requirements of CS 25B1093(b)(2), including Appendix C, is given in this paragraph.
2.4.1 When the tests are conducted in non-altitude conditions, the system power supply and the
external aero-dynamic and atmospheric conditions should be so modified as to represent the required
altitude conditions as closely as possible. The altitudes to be represented should be as indicated in
Table 1 for simulated tests, or that appropriate to the desired temperature in flight tests, except that the
test altitude need not exceed any limitations proposed for approval. The appropriate intake incidences
or the most critical incidence, should be simulated.
2.4.2 Two tests (which may be separated or combined) should be conducted at each temperature
condition of Table 1, at or near the indicated altitude –
TABLE 1
2.4.3 At the conclusion of each of the tests of 2.4.2 the ice accretion should be such as not to
adversely affect the subsequent running and functioning of the APU.
2.4.4 If the APU intake contains features or devices which could be affected by freezing fog
conditions then in addition to the above tests of 2.4.2 a separate test on these parts or devices should
be conducted for a duration of 30 minutes with the heat supply to the tested parts as would be
available with the APU set to the minimum ground idle conditions approved for use in icing in an
atmosphere of –2°C and a liquid water concentration of 0·3 g/m3. The mean effective droplet size for
the test should be 20 µm. At the end of the period the ice accretion on the tested part should not
prevent its proper functioning nor should the ice be of such size as to hazard the APU if shed.
2–J–3
CS–25 BOOK 2
3.2 The intake may be tested with the APU in accordance with a programme of tests which results
from an analysis of the icing conditions and the APU conditions appropriate to the installation.
3.3 When the intake is assessed separately it should be shown that the effects of intake icing
would not invalidate any APU certification tests. Factors to be considered in such evaluation are –
b. The shedding into the APU of intake ice of a size greater than the APU is known to be able to
ingest.
c. The icing of any APU sensing devices, other subsidiary intakes or equipment contained within
the intake.
d. The time required to bring the protective system into full operation.
3.4 When tests are conducted in non-altitude conditions, the system power supply and the external
aerodynamic and atmospheric conditions should be so modified as to represent the altitude condition
as closely as possible. The appropriate intake incidences or the most critical incidence, should be
simulated.
3.5 Following the analysis required in CS 25.1419(b), which will determine the critical icing
conditions within the envelope of icing conditions defined by Appendix C Figures 1 to 3 and Appendix
C Figures 4 to 6, tests should be conducted at such conditions as are required to demonstrate the
adequacy of the design points.
3.6 At the conclusion of each of the tests the ice accretion should be such as not to adversely
affect the subsequent running and functioning of the APU.
3.7 If the APU intake contains features or devices which could be affected by freezing fog
conditions then a separate assessment for these parts should be conducted assuming a duration of 30
minutes and an atmosphere of –2°C and a liquid water concentration of 0·3 g/m3, with the heat supply
to the part as would be available with the APU set to the minimum ground idle conditions approved for
use in icing. The mean effective droplet size should be 20 µm. At the end of the period the ice
accretion on the part should not prevent its proper functioning, nor should the ice be of such size as to
hazard the engine if shed.
AMC 25A1195(b)
Fire Extinguisher Systems (Auxiliary Power Units)
Acceptable methods to establish the adequacy of the fire extinguisher system are laid down in FAA
Advisory Circular 20 – 100.
2–J–4
BOOK 2 CS–25
AMC – APPENDICES
The air distribution is to be determined by the equipment design. The 3-to-1 ratio described in this
paragraph is approximate. An external air distribution system which will deliver that ratio precisely is
not permitted as a substitute for the air distributor plates.
In order to accommodate specimens which distort and delaminate during testing, two 0·508 mm
(0·020-inch) stainless steel wires should be used to secure the specimens to the holder during the
testing.
These wires should be used with all specimens and are in addition to the drip pan that should be used
for materials which are prone to melting and dripping.
Various installations have experienced difficulties with the pilot burners being extinguished during the
test.
The following revisions to the pilot burner configurations have been found to be acceptable:
(1) For the lower pilot burner – a sparking device which either sparks automatically at
approximately ½ to 1 second intervals or is manually operated, which requires continuous monitoring
of the pilot flame.
Note: This requires that the laboratory test procedure specifies that the technician must continuously monitor the pilot for
each test and that failure to do so will invalidate the test results.
(2) For the upper pilot burner – a manual or automatic sparking device or a revision to the hole
system in the burner. One approved deviation utilises 14 holes using a number 59 drill bit.
The outer door should be closed between tests to maintain the heat within the chamber. It is
recommended that the outer door be hinged to facilitate implementing this recommendation. If a
detachable door is used, a separate door should be installed during sample holder preparation and
installation. This recommendation is based on the 40-seconds holding time (60 seconds less
20 seconds of data acquisition time) required in (e)(4), being insufficient to allow the chamber to reach
equilibrium, if the outer door is open for too long between tests.
2–App F–1
CS–25 BOOK 2
It has been found that a typical range for the calibration factor is 8 to 15. If a calibration factor is
calculated which falls outside this range, the calculation should be reviewed.
If the factor continues to fall outside this range, the Agency should be contacted.
2–App F–2
BOOK 2 CS-25
GENERAL
ACCEPTABLE MEANS OF COMPLIANCE – AMC
AMC 25-11
Electronic Display Systems
Purpose
This Acceptable Means of Compliance (AMC) provides guidance for certification of cathode ray tube
(CRT) based electronic display systems used for guidance, control, or decision-making by the pilots of
transport category aeroplanes. Like all acceptable means of compliance, this document is not, in itself,
mandatory and does not constitute a regulation. It is issued to provide guidance and to outline a
method of compliance with the rules.
This AMC is similar to FAA Advisory Circular AC 25-11 dated 16 July 1987.
Scope
The material provided in this AMC consists of guidance related to pilot displays and specifications for
CRTs in the cockpit of commercial transport aeroplanes. The content of the AMC is limited to
statements of general certification considerations, including display function criticality and compliance
considerations; colour, symbology, coding, clutter, dimensionality, and attention-getting requirements;
display visual characteristics; failure modes; information display and formatting; specific integrated
display and mode considerations, including maps, propulsion parameters, warning, advisory, check list
procedures and status displays.
1 BACKGROUND
a. The initial certification of CRTs as primary flight instruments, both in Europe and the United
States, was coincident with major airframe certifications. The prime airframe manufacturers invested
extensive preliminary laboratory work to define the system architecture, software design, colours,
symbols, formats, and types of information to be presented, and to prove that these resulting displays
would provide an acceptable level of safety. The flight test programmes gave many hours exposure of
the electronic display systems to company test pilots, Agency test pilots, and customer pilots.
Certification of the displays came at the end of this process. Because of this pre-certification
exposure, the Agency had a high degree of confidence that these displays were adequate for their
intended function and safe to use in foreseeable normal and failed conditions.
b. The initial electronic display designs tended to copy the electromechanical display formats. As
a result, pilots have evaluated the new displays using the electromechanical displays as a reference.
As electronic display systems evolve, there is great potential for significant improvements in
information interchange between the system (aeroplane) and the pilot. The Agency intends to allow a
certification environment that will provide the greatest flexibility commensurate with safety.
2 GLOSSARY OF ACRONYMS
2-GEN–1
CS-25 BOOK 2
a. Requirements
Compliance with many paragraphs of CS-25 may be related to, or dependent on, cockpit displays,
even though the regulations may not explicitly state display requirements. Some applicable
paragraphs of CS-25 are listed below. The particular compliance method chosen for other regulations
not listed here may also require their inclusion if CRT displays are used in the flight deck.
2-GEN–2
BOOK 2 CS-25
CS-AWO All Weather Operations (Subpart 2 Cat II Operations and Subpart 3 Cat III
Operations)
Operational regulations relative to instrument and equipment requirements
d. Industry Documents
(1) The following documents are available from the EUROCAE 11, rue Hamelin 75783, Paris
Cedex 16, France:
2-GEN–3
CS-25 BOOK 2
(2) The following documents are available from the Society of Automotive Engineers, Inc. (SAE),
400 Commonwealth Drive, Warrendale, PA. 15096, USA:
ARP 268F Location and Actuation of Flight Deck Controls for Transport Aircraft.
ARP 1068B Flight Deck Instrumentation, Display Criteria and Associated Controls for
Transport Aircraft.
ARP 1093 Numeral, Letter and Symbol Dimensions for Aircraft Instrument Displays.
ARP 1874 Design Objectives for CRT Displays for Part 25 (Transport) Aircraft.
ARP 1782 Photometric and Colormetric Measurement Procedures for Direct View CRT
Display Systems.
NOTE: In the event of conflicting information, this AMC takes precedence as guidance for certification of transport
category aeroplane installations.
e. Research Reports. The following documents are available through the National Technical
Information Service, Springfield, Virginia 22161, USA:
Introductory Note: When Improbable means Extremely Remote the latter is used, otherwise it means
Remote.
2-GEN–4
BOOK 2 CS-25
a. Display Function Criticality. The use of electronic displays allows designers to integrate
systems to a much higher degree than was practical with previous aeroplane flight deck components.
With this integration can come much greater simplicity of operation of the aeroplane through
automation of navigation, thrust, aeroplane control, and the related display systems. Although normal
operation of the aeroplane may become easier, failure state evaluation and the determination of
criticality of display functions may become more complex. This determination should refer to the
display function and include all causes that could affect the display of that function, not only the display
equipment. ‘Loss of display,’ for example, means ‘loss of capability to display’.
(1) Criticality of flight and navigation data displayed should be evaluated in accordance with the
requirements in CS 25.1309 and 25.1333. AMC 25.1309-1 clarifies the meaning of these requirements
and the types of analyses that are appropriate to show that systems meet them. AMC 25.1309-1 also
provides criteria to correlate the depth of analyses required with the type of function the system
performs (non-essential, essential or critical); however, a system may normally be performing non-
essential or essential functions from the standpoint of required availability and have potential failure
modes that could be more critical. In this case, a higher level of criticality applies. Pilot evaluation
may be a necessary input in making the determination of criticality for electronic displays. AMC
25.1309-1 recommends that the flight test pilot –
(iii) Determines if the necessary actions can be satisfactorily accomplished in a timely manner
without exceptional pilot skill or strength.
(2) Software-based systems should have the computer software verified and validated in an
acceptable manner. One acceptable means of compliance for the verification and validation of
computer software is outlined in ED12A/DO-178A. Software documentation appropriate to the level to
which the verification and validation of the computer software has been accomplished should be
provided as noted in ED12A/DO178A.
(3) Past certification programs have resulted in the following determinations of display criticality.
Unconventional aeroplane and display design may change these assessments. In the failure cases
discussed below, hazardously misleading failures are, by definition, not associated with a suitable
warning.
(i) Attitude. Display of attitude in the cockpit is a critical function. Loss of all attitude display,
including standby attitude, is a critical failure and must be Extremely Improbable. Loss of primary
attitude display for both pilots must be Improbable. Display of hazardously misleading roll or pitch
attitude simultaneously on the primary attitude displays for both pilots must be Extremely Improbable.
Display of dangerously incorrect roll or pitch attitude on any single primary attitude display, without a
warning must be Extremely Remote.
(ii) Airspeed. Display of airspeed in the cockpit is a critical function. Loss of all airspeed display,
including standby, must be assessed in accordance with CS 25.1333(b). * Loss of primary airspeed
display for both pilots must be Improbable. Displaying hazardously misleading airspeed
simultaneously on both pilots’ displays, coupled with the loss of stall warning or overspeed warning
functions, must be Extremely Improbable.
(iii) Barometric Altitude. Display of altitude in the cockpit is a critical function. Loss of all altitude
display, including standby, must be assessed in accordance with CS 25.1333(b). * Loss of primary
altitude display for both pilots must be Improbable. Displaying hazardously misleading altitude
simultaneously on both pilots’ displays must be Extremely Improbable.
2-GEN–5
CS-25 BOOK 2
(iv) Vertical Speed. Display of vertical speed in the cockpit is an essential function. Loss of
vertical speed display to both pilots must be Improbable.
(v) Rate-of-Turn Indication. The rate-of-turn indication is a non-essential function and is not
required if the requirements of paragraph 4a(3)(i) are met.
(vi) Slip/Skid Indication. The slip/skid or sideslip indication is an essential function. Loss of this
function to both pilots must be Improbable. Simultaneously misleading slip/skid or sideslip information
to both pilots must be Improbable.
(vii) Heading. Display of stabilised heading in the cockpit is an essential function. Displaying
hazardously misleading heading information on both pilots’ primary displays must be Improbable. Loss
of stabilised heading in the cockpit must be Improbable. Loss of all heading display must be assessed
in accordance with CS 25.1333(b). *
(viii) Navigation. Display of navigation information (excluding heading, airspeed, and clock data) in
the cockpit is an essential function. Loss of all navigation information must be Improbable. Displaying
hazardously misleading navigational or positional information simultaneously on both pilots’ displays
must be Improbable.
NOTE: Because of a relationship between navigation capability and communicated navigation information, the following
related requirements are included. Non-restorable loss of all navigation and communication functions must be Extremely
Improbable. Loss of all communication functions must be Improbable.
(A) The required powerplant instrument displays must be designed and installed so that
the failure or malfunction of any system or component that affects the display or
accuracy of any propulsion system parameter for one engine will not cause the
permanent loss of display or adversely affect the accuracy of any parameter for the
remaining engines.
(B) No single fault, failure, or malfunction, or probable combinations of failures, shall result
in the permanent loss of display, or in the misleading display, of more than one
propulsion unit parameter essential for safe operation of a single engine.
(C) Combinations of failures, which would result in the permanent loss of any single,
required powerplant parameter displays for more than one engine must be
Improbable.
(D) Combinations of failures, which would result in the hazardously misleading display of
any parameter for more than one engine, must be Extremely Improbable.
2-GEN–6
BOOK 2 CS-25
(F) Required powerplant instruments that are not displayed continuously must be
automatically displayed when any inhibited parameter exceeds an operating limit or
threshold, including fuel tank low-fuel advisory or maximum imbalance limit, unless
concurrent failure conditions are identified where crew attention to other system
displays takes priority over the powerplant instruments for continued safe operation of
the aeroplane. In each case, it must be established that failure to concurrently display
the powerplant instruments does not jeopardise the safe operation of the aeroplane.
(G) Propulsion system parameters essential for determining the health and operational
status of the engines and for taking appropriate corrective action, including engine
restart, must be automatically displayed after the loss of normal electrical power.
(H) If individual fuel tank quantity information is not continuously displayed, there must be
adequate automatic monitoring of the fuel system to alert the crew of both system
malfunctions and abnormal fuel management.
(x) Crew alerting display. The reliability of the alerting display should be compatible with the
safety objectives associated with the system function for which it provides an alert. Crew alerting of
certain parameters may be an essential function. Where this is so, loss of crew alerting should be
Improbable (see AMC 25.1322).
(xi) Flight crew Procedures. The display of hazardously misleading flight crew procedures caused
by display system failure, malfunction, or mis-design must be Improbable.
(xii) Weather Radar. Display of weather radar in the cockpit is a nonessential function; however,
presentation of hazardously misleading information must be Improbable.
NOTE: Operational rules may require the installation and functioning of weather radar.
b. Compliance Considerations
(1) Human Factors. Humans are very adaptable, but unfortunately for the display evaluation
process, they adapt at varying rates with varying degrees of effectiveness and mental processing
compensation. Thus, what some pilots might find acceptable and approvable, others would reject as
being unusable and unsafe. Aeroplane displays must be effective when used by pilots who cover the
entire spectrum of variability. Relying on a requirement of ‘train to proficiency’ may be unenforceable,
economically impracticable, or unachievable by some pilots without excessive mental workload as
compensation.
(i) The test programme should include sufficient flight and simulation time, using a representative
population of pilots, to substantiate –
(C) Acceptable interpretation error rates equivalent to or less than conventional displays;
(D) Proper integration with other equipment that uses electronic display functions;
(E) Acceptability of all failure modes not shown to be Extremely Improbable; and
2-GEN–7
CS-25 BOOK 2
The manufacturers should provide human factors support for their decisions regarding new or unique
features in a display. Evaluation pilots should verify that the data supports a conclusion that any new
or unique features have no human factors traps or pitfalls, such as display perceptual or interpretative
problems, for a representative pilot population.
(ii) It is desirable to have display evaluations conducted by more than one pilot, even for the
certification of displays that do not incorporate significant new features. At least one member of the
team should have previous experience with the display principles contained in this document. For
display designs that incorporate unproven features, evaluation by a greater number of pilots should be
considered. To help the Agency certification team gain assurance of a sufficiently broad exposure
base, the electronic display manufacturer or installer should develop a test programme with the Agency
that gathers data from Agency test pilots, company test pilots, and customer pilots who will use the
display. A reasonable amount of time for the pilot to adapt to a display feature can be allowed, but
long adaptation times must receive careful consideration. Any attitude display format presented for
Agency approval should be sufficiently natural in its design so that no training is required for basic
manual aeroplane control.
(iii) For those electronic display systems that have been previously approved (including display
formats) and are to be installed in aeroplanes in which these systems have not been previously
approved, a routine Agency certification should be conducted. This programme should emphasise the
systems’ integration in the aeroplane, taking into account the operational aspects, which may require
further detailed systems failure analysis (where ‘system’ means the display, driving electronics,
sensors and sources of information).
(iv) Simulation is an invaluable tool for display evaluation. Acceptable simulation ranges from a
rudimentary bench test set up, where the display elements are viewed statically, to full flight training
simulation with motion, external visual scene, and entire aeroplane systems representation. For minor
or simple changes to previously approved displays, one of these levels of simulation may be deemed
adequate for display evaluation. For evaluation of display elements that relate directly to aeroplane
control (i.e. air data, attitude, thrust set parameters, etc.), simulation should not be relied upon entirely.
The dynamics of aeroplane motion, coupled with the many added distractions and sensory demands
made upon the pilot that are attendant to actual aeroplane flight, have a profound effect on the pilot’s
perception and usability of displays. Display designers, as well as Agency test pilots, should be aware
that display formats previously approved in simulation may well (and frequently do) turn out to be
unacceptable in actual flight.
(i) It is assumed that all display equipment has met the requirements set forth in SAE Document
AS 8034 or guidance provided in ETSO-C113. Therefore, the purpose of the following guidance is to
ensure compatibility of the flight-qualified equipment with the aeroplane environment. It is recognised
that the validation of acceptable equipment installations considers the individual and combined effects
of the following: temperature, altitude, electromagnetic interference, radiomagnetic interference,
vibration, and other environmental influences. The installation requirements of CS-25 are applicable to
critical, essential, and nonessential systems, and should be determined on a case-by-case basis by the
Agency based on the specific circumstances.
(A) Analysis and testing shall be conducted to ensure proper operation of the display at
the maximum unpressurised altitude for which the equipment is likely to be exposed.
2-GEN–8
BOOK 2 CS-25
(1) That the installed system is not susceptible to interference from other
aeroplane systems, considering both interference of signal and power
systems; and from external environment; and
(2) That the installed equipment does not affect other aeroplane systems.
(C) If improper operation of the display system can result from failures of the cooling
function, then the cooling function must be addressed by analysis and
test/demonstration.
(ii) Pilot-initiated pre-flight tests may be used to reduce failure exposure times associated with the
safety analysis required under CS 25.1309(d). However, expecting an equipment pre-flight test to be
conducted prior to each flight may not be conservative. If the flight crew is required to test a system
prior to each flight, it should be assumed, for the safety analysis, that the flight crew will actually
accomplish this test once per day, providing the pre-flight test is conveniently and acceptably
implemented. An automatic-test feature designed to preclude the need for pilot initiated pre-flight tests
may receive credit in the safety analysis.
5 INFORMATION SEPARATION
a. Colour Standardisation
(1) Although colour standardisation is desirable, during the initial certification of electronic displays
colour standards for symbology were not imposed (except for cautions and warnings in CS 25.1322).
At that time the expertise did not exist within industry or the Agency, nor did sufficient service
experience exist, to rationally establish a suitable colour standard.
(2) In spite of the permissive CRT colour atmosphere that existed at the time of initial EFIS
certification programmes, an analysis of the major certifications to date reveals many areas of common
colour design philosophy; however, if left unrestricted, in several years there will be few remaining
common areas of colour selection. If that is the case, information transfer problems may begin to
occur that have significant safety implications. To preclude this, the following colours are being
recommended based on current-day common usage. Deviations may be approved with acceptable
justification.
(3) The following depicts acceptable display colours related to their functional meaning
recommended for electronic display systems.
Warnings Red
Flight envelope and system limits Red
Cautions, abnormal sources Amber/Yellow
Earth Tan/Brown
Engaged modes Green
Sky Cyan/Blue
ILS deviation pointer Magenta
Flight director bar Magenta/Green
(ii) Specified display features should be allocated colours from one of the following colour sets:
2-GEN–9
CS-25 BOOK 2
* The extensive use of the colour yellow for other than caution/abnormal information is
discouraged.
** In colour Set 1, magenta is intended to be associated with those analogue parameters that
constitute ‘fly to’ or ‘keep centred’ type information.
(4) When deviating from any of the above symbol colour assignments, the manufacturer should
ensure that the chosen colour set is not susceptible to confusion or colour meaning transference
problems due to dissimilarities with this standard. The Agency test pilot should be familiar with other
systems in use and evaluate the system specifically for confusion in colour meanings. In addition,
compatibility with electro-mechanical instruments should be considered.
(5) The Agency does not intend to limit electronic displays to the above colours, although they
have been shown to work well. The colours available from a symbol generator/display unit
combination should be carefully selected on the basis of their chrominance separation. Research
studies indicate that regions of relatively high colour confusion exist between red and magenta,
magenta and purple, cyan and green, and yellow and orange (amber). Colours should track with
brightness so that chrominance and relative chrominance separation are maintained as much as
possible over day/night operation. Requiring the flight crew to discriminate between shades of the
same colour for symbol meaning in one display is not recommended.
(6) Chrominance uniformity should be in accordance with the guidance provided in SAE Document
ARP 1874. As designs are finalised, the manufacturer should review his colour selections to ensure
the presence of colour works to the advantage of separating logical electronic display functions or
separation of types of displayed data. Colour meanings should be consistent throughout all colour
CRT displays in the cockpit. In the past, no criteria existed requiring similar colour schemes for left
and right side installations using electro-mechanical instruments.
(1) When colour displays are used, colours should be selected to minimise display interpretation
workload. Symbol colouring should be related to the task or crew operation function. Improper colour
coding increases response times for display item recognition and selection, and increases the
likelihood of errors in situations where response rate demands exceed response accuracy demands.
Colour assignments that differ from other displays in use, either electromechanical or electronic, or that
differ from common usage (such as red, yellow, and green for stoplights), can potentially lead to
confusion and information transferral problems.
(2) When symbology is configured such that symbol characterisation is not based on colour
contrast alone, but on shape as well, then the colour information is seen to add a desirable degree of
redundancy to the displayed information. There are conditions in which pilots whose vision is colour
2-GEN–10
BOOK 2 CS-25
deficient can obtain waivers for medical qualifications under crew licence regulations. In addition,
normal ageing of the eye can reduce the ability to sharply focus on red objects, or discriminate
blue/green. For pilots with such deficiency, display interpretation workload may be unacceptably
increased unless symbology is coded in more dimensions than colour alone. Each symbol that needs
separation because of the criticality of its information content should be identified by at least two
distinctive coding parameters (size, shape, colour, location, etc.).
(3) Colour diversity should be limited to as few colours as practical, to ensure adequate colour
contrast between symbols. Colour grouping of symbols, annunciations, and flags should follow a
logical scheme. The contribution of colour to information density should not make the display
interpretation times so long that the pilot perceives a cluttered display.
d. Symbol Position
(1) The position of a message or symbol within a display conveys meaning to the pilot. Without
the consistent or repeatable location of a symbol in a specific area of the electronic display,
interpretation errors and response times may increase. The following symbols and parameters should
be position consistent:
(iv) All sensor failure flags. (Where appropriate, flags should appear in the area where the data is
normally placed.)
(v) Either the pointer or scale for analogue quantities should be fixed. (Moving scale indicators
that have a fixed present value may have variable limit markings.)
(2) An evaluation of the positions of the different types of alerting messages and annunciations
available within the electronic display should be conducted, with particular attention given to
differentiation of normal and abnormal indications. There should be no tendency to misinterpret or fail
to discern a symbol, alert, or annunciation, due to an abnormal indication being displayed in the
position of a normal indication, and having similar shape, size or colour.
(3) Pilot and co-pilot displays may have minor differences in format, but all such differences
should be evaluated specifically to ensure that no potential for interpretation error exists when pilots
make cross-side display comparisons.
(4) If the display incorporates slow rate ‘dithering’ to reduce phosphor burn from stationary
symbology, the entire display should be moved at a slow rate in order to not change the spatial
relationships of the symbology collection as a whole.
e. Clutter. A cluttered display is one, which uses an excessive number and/or variety of symbols,
colours, or small spatial relationships. This causes increased processing time for display
interpretation. One of the goals of display format design is to convey information in a simple fashion in
order to reduce display interpretation time. A related issue is the amount of information presented to
the pilot. As this increases, tasks become more difficult as secondary information may detract from the
interpretation of information necessary for the primary task. A second goal of display format design is
2-GEN–11
CS-25 BOOK 2
to determine what information the pilot actually requires in order to perform the task at hand. This will
serve to limit the amount of information that needs to be presented at any point in time. Addition of
information by pilot selection may be desirable, particularly in the case of navigational displays, as long
as the basic display modes remain uncluttered after pilot de-selection of secondary data. Automatic
de-selection of data has been allowed in the past to enhance the pilot’s performance in certain
emergency conditions (de-selection of AFCS engaged mode annunciation and flight director in extreme
attitudes).
NOTE: Horizon lines and pitch scales which overwrite the fixed aeroplane symbol or roll pointer have been found
unacceptable in the past.
g. Attention-Getting Requirements
(1) Some electronic display functions are intended to alert the pilot to changes: navigation sensor
status changes (VOR flag), computed data status changes (flight director flag or command cue
removal), and flight control system normal mode changes (annunciator changes from armed to
engaged) are a few examples. For the displayed information to be effective as an attention-getter,
some easily noticeable change must be evident. A legend change by itself is inadequate to annunciate
automatic or uncommanded mode changes. Colour changes may seem adequate in low light levels or
during laboratory demonstrations but become much less effective at high ambient light levels. Motion
is an excellent attention-getting device. Symbol shape changes are also effective, such as placing a
box around freshly changed information. Short-term flashing symbols (approximately 10 seconds or
flash until acknowledge) are effective attention-getters. A permanent or long-term flashing symbol that
is non-cancellable should not be used.
(2) In some operations, continued operation with inoperative equipment is allowed (under
provisions of an MEL). The display designer should consider the applicant’s MEL desires, because in
some cases a continuous strong alert may be too distracting for continued dispatch.
h. Colour Drive Failure. Following a single colour drive failure, the remaining symbology should
not present misleading information, although the display does not have to be usable. If the failure is
obvious, it may be assumed that the pilot will not be susceptible to misleading information due to
partial loss of symbology. To make this assumption valid, special cautions may have to be included in
the AFM procedures that point out to the pilot that important information formed from a single primary
colour may be lost, such as red flags.
2-GEN–12
BOOK 2 CS-25
a. Visual Display Characteristics. The visual display characteristics of electronic displays should
be in accordance with SAE Documents AS 8034, ARP 1874, and ARP 1068B. The manufacturer
should notify the certification engineer of those characteristics that do not meet the guidelines
contained in the referenced documents.
(1) Readability of the displays should be satisfactory in all operating and environmental lighting
conditions expected in service. Four lighting conditions known to be critical for testing are –
(i) Direct sunlight on the display through a side cockpit window (usually short term with
conventional window arrangements).
(ii) Sunlight through a front window illuminating white shirts, which are reflected in the CRT (a
function for the CRT front plate filter).
(iii) Sun above the forward horizon and above a cloud deck in the pilot’s eyes (usually a prolonged
situation and the most critical of these four).
(iv) Night and/or dark environment. Brightness should be controllable to a dim enough setting
such that outside vision is not impaired while maintaining an acceptable presentation.
(2) When displays are evaluated in these critical lighting situations, the display should be adjusted
to a brightness level representative of that expected at the end of the CRT’s normal useful life (5000 to
20000 hours), or adjusted to a brightness level selected by the manufacturer as the minimum
acceptable output and measurable by some readily accomplished maintenance tests. If the former
method is used, adequate evaluations should be performed to ensure that the expected end of life
brightness levels are met. Some manufacturers have found, and the Agency has accepted, that 50%
of original brightness level is a realistic end of life value. If the latter method is used, procedures
should be established to require periodic inspections, and these limits should then become part of the
service life limits of the aeroplane system.
(3) Large fields used in colour displays as background (e.g. blue sky and brown earth for attitude)
for primary flight control symbols need not be easily discriminated in these high ambient light levels,
provided the proper sense of the flight control information is conveyed with a quick glance.
(4) Electronic display systems should meet the luminance (photometric brightness) levels of SAE
Document ARP 1874. A system designed to meet these standards should be readily visible in all the
lighting conditions listed in paragraphs 6.b. (1) and 6.b. (2), and should not require specific flight
testing for luminance if the system has been previously installed in another aeroplane with similar
cockpit window arrangements. If the display evaluation team feels that some attributes are marginal
under extreme lighting conditions, the following guidelines may be used:
(i) The symbols that convey quick-glance attitude and flight path control information (e.g., horizon
line, pitch scale, fixed aeroplane symbol and/or flight path symbol, sky pointer and bank indices, flight
director bars) should each have adequate brightness contrast with its respective background to allow it
to be easily and clearly discernible.
(ii) The combination of colour and brightness of any subset of these symbols, which may, due to
relative motion of a dynamic display, move adjacent to each other and use colour as an aid for symbol
separation (e.g. flight director bars and fixed aeroplane symbol), should render each symbol distinctly
identifiable in the worst case juxtaposition.
(iii) Flags and annunciations that may relate to events of a time critical nature (including warnings
and cautions defined in paragraph 10. of this AMC as well as flight control system annunciations of
2-GEN–13
CS-25 BOOK 2
mode reversions) should have a sufficient contrast with their background and immediate environment
to achieve an adequate level of attensity (attention getting properties). Colour discrimination in high
brightness ambient levels may not be necessary if the symbol remains unambiguous and clearly
distinct from adjacent normal state or alphanumeric characters.
(iv) Analogue scale displays (heading, air data, engine data, CDIs, or course lines) should each
have adequate brightness with its respective background to allow it to be easily and clearly discernible.
Coloured warning and caution markings on scales should retain colour discrimination. Symbols used
as targets and present value pointers in juxtaposition to a scale should remain distinct. If colour is
required to convey the meaning of similar shaped targets or indices, the colour should remain easily
discernible.
(v) Flags and annunciations should still be visible at low display brightness when the display is
adjusted to the lowest usable level for flight with normal symbology (day or night).
(vi) Raster fields conveying information such as weather radar displays should allow the raster to
be independently adjustable in luminance from overlaid stroke symbology. The range of luminance
control should allow detection of colour difference between adjacent small raster areas no larger than 5
milliradians in principal dimension; while at this setting, overlying map symbology, if present, should be
discernible.
(5) Automatic brightness adjustment systems can be employed to decrease pilot workload and
increase tube lifetime. Operation of these systems should be satisfactory over a wide range of ambient
light conditions including the extreme cases of a forward low sun and a quartering rearward sun
shining directly on the display. A measure of manual adjustment should be retained to provide for
normal and abnormal operating differences. In the past it has been found that sensor location and field
of view may as significant as the tube brightness dynamics. Glareshield geometry and window location
should be considered in the evaluation.
c. Other Characteristics
The displays should provide characteristics which comply with the symbol alignment, linearity, jitter,
convergence, focus, line width, symbol and character size, chrominance uniformity, and reflection
criteria of SAE Documents ARP 1874 and AS 8034. Any features, which do not comply with these
documents should be identified. The Agency test team should evaluate these characteristics during
the initial certification of the displays as installed in the aeroplane with special attention to those
display details which do not comply with the criteria of ARP 1874 and AS 8034. The test team will
provide the determination of whether these characteristics of the display are satisfactory.
d. Flicker
Flicker is an undesired rapid temporal variation in display luminance of a symbol, group of symbols, or
a luminous field. Flicker can cause mild fatigue and reduced crew efficiency. Since it is a subjective
phenomena, the criteria cannot be ‘no flicker’; but because of the potential deleterious effects, the
presence of flicker should not be perceptible day or night considering fovea and full peripheral vision
and a format most susceptible to producing flicker. Refresh rate is a major determinant of flicker;
related parameters are phosphor persistence and the method of generating mixed colours. Some
systems will also slow down the screen refresh rate when the data content is increased (as in a map
display with selectable data content). Frequencies above 55 Hz for stroke symbology or non-interlaced
raster and 30/60 Hz for interlaced raster are generally satisfactory.
e. Dynamics
For those elements of the display that are normally in motion, any jitter, jerkiness, or ratcheting effect
should neither be distracting nor objectionable. Screen data update rates for analogue symbols used
in direct aeroplane or powerplant manual control tasks (such as attitude, engine parameters, etc.)
should be equal to or greater than 15 Hz. Any lag introduced by the display system should be
2-GEN–14
BOOK 2 CS-25
consistent with the aeroplane control task associated with that parameter. In particular, display system
lag (including the sensor) for attitude should not exceed a first order equivalent time constant of 100
milliseconds for aeroplanes with conventional control system response. Evaluation should be
conducted in worst-case aerodynamic conditions with appropriate stability augmentation systems off in
order to determine the acceptability of display lag.
Note: An update rate of 10 Hz for some engine parameters has been found acceptable on some aeroplanes.
7 INFORMATION DISPLAY
Display elements and symbology used in real-time ‘tactical’ aeroplane control should be natural,
intuitive, and not dependent on training or adaptation for correct interpretation.
a. Basic T
The established basic T relationships of CS 25.1321 should be retained. Deviations from this rule, as
by equivalent safety findings, cannot be granted without human factors substantiation based on well-
founded research or extensive service experience from military, foreign, or other sources.
(1) Deviations from the basic T that have been substantiated by satisfactory service experience
and research are as follows:
(i) Airspeed and altitude instruments external to the attitude display drooped up to 15 degrees
and elevated up to 10 degrees (when measured from the centre of the attitude fixed aeroplane
reference to the centre of the air data instrument).
(ii) Vertical scale type radio altimeter indication between the attitude and altitude displays.
(iii) Vertical scale display of vertical speed between attitude and altitude displays.
(2) Airspeed and altitude within the electronic display should be arranged so that the present
value of the displayed parameter is located as close as possible to a horizontal line extending from the
centre of the attitude indicator. The present value of heading should be vertically underneath the
centre of the attitude indicator; this does not preclude an additional heading display located
horizontally from the attitude display.
(i) Moving scale air data displays should have their present value aligned with the centre of the
attitude display fixed aeroplane reference.
(ii) A single fixed airspeed scale with a moving pointer would optimally have certain critical ranges
where the present value (or pointer position) for those ranges is within 15 degrees of a horizontal line
from the attitude display fixed aeroplane reference; e.g. take-off speeds (highly dynamic) and cruise
speeds (long exposure). For aeroplanes with a large speed differential between take-off and cruise,
the linear trade-off with speed resolution may preclude meeting this objective. In these cases, the
manufacturer should prove that instrument scan, cross-check, and readability are acceptable for all
expected normal and abnormal manoeuvres and applicable failure states of the aeroplane, including
variability of the user pilot population.
(iii) Multiple range, fixed airspeed scales with moving pointers should be designed so that take-off
and approach speed values are located within 15 degrees of a horizontal line through the attitude
display fixed aeroplane reference symbol. The range switching point and hysteresis should be logically
selected so that switching is unobtrusive and not detrimental to current speed tracking tasks or
dynamic interpretation. Attributes of the individual scales must be such that there is no tendency for the
pilot to lose the sense of context of speed range or misinterpret the displayed speed scale.
(3) In cases of adjacent air data instruments, such as a vertical scale airspeed inside an EADI and
a conventional airspeed outside the EADI, the display closest to the primary attitude display will be
2-GEN–15
CS-25 BOOK 2
considered the primary display, except in the case of supplementary displays where adequate human
factors analysis and testing have been conducted to establish that the supplementary display does not
decrease the level of safety from that provided by the primary display by itself (Example: fast/slow
indicators).
(4) For retrofit of electronic displays into aeroplanes that previously exhibited variance from a
basic T configuration, the electronic display installation should not increase this variance when
considering the angle from the centre of the attitude reference to the centre of the airspeed and
altimeter.
(5) The acceptability of a so-called ‘cruise’ mode in which the upper EADI and lower EHSI display
formats may be transposed will be considered on a case-by-case basis by the Agency.
(6) Instrument landing system glideslope raw data display has been allowed on either side of the
electronic display. If glideslope raw data is presented on both the EHSI and EADI, they should be on
the same side. The Agency recommends a standard location of glideslope scales on the right side as
specified in SAE Document ARP 1068B. If the scale or its location is multifunctional, then it should be
labelled and contain some unambiguous symbolic attribute related to the indicator’s function.
(7) Compliance with CS 25.1333 normally requires separate displays of standby attitude, air data,
and heading. Since these displays are only used after a failure related to the primary instruments, the
basic T arrangement requirements do not apply. However, all the standby instruments should be
arranged to be easily usable by one of the pilots. CS 25.1321(a) requires a third (standby) instrument,
where fitted, to be installed so that both pilots can use it. AMC 25.1321(a) allows that where an
optimum position for both pilots is not possible, any bias should be in favour of the first pilot.
b. Compacted Formats
(1) The term ‘compacted format’, as used in this AMC, refers to a reversionary display mode
where selected display components of a two-tube CRT display, such as EADI and EHSI, are combined
in a single CRT to provide somewhat better capability in case of a single tube failure. The concepts
and requirements of JAR 25.1321, as discussed in paragraph 7.a., still apply; however, it has been
found acceptable to allow a compacted mode on either the EADI or EHSI after failure of one CRT.
(2) The compacted display, out of necessity, will be quite different from the primary format. Flags,
mode annunciations, scales, and pointers may have different locations and perhaps different logic
governing when they appear. The flight test evaluation should ensure the proper operation of all the
electronic display functions in the compacted format, including annunciation of navigation and
guidance modes if present. All the normal EFIS functions do not have to be present in the compacted
mode; those that are present should operate properly. Flags and mode annunciations should,
wherever possible, be displayed in a location common with the normal format. In all cases the attitude
display should meet the characteristics of paragraph 7.e.
(3) If the remaining elements of the compacted upper display meet the characteristics of this
document and the CS and operational regulations governing required instrumentation, then a note in
the AFM stating that the compacted display is an airworthy mode would be acceptable in order to allow
dispatch with a failed lower tube configuration.
c. Test Functions
The electronic display should incorporate a pilot selectable or automatic test mode that exercises the
system to a depth appropriate to the system design. This function should be included even if the
system failure analysis is not dependent on such a mode, or if display test is also a maintenance
function. The test mode (or a submode) should display warning flags in their proper locations. Alerting
and annunciation functions should be exercised, but it normally would not be necessary for the test to
cycle through all possible annunciation states, or to display all flags and alerts. It has been found
acceptable to incorporate the display test with a centralised cockpit light test switch, and to have the
2-GEN–16
BOOK 2 CS-25
display test function disabled while airborne. The test mode provides a convenient means to display
the software configuration.
Note: It is understood that a pilot selectable test needs to be provided, even if the system failure analysis is not
dependent on such a mode to enable the pilot to become familiar with the various failure flags and annunciations which
may appear. It is considered that such a requirement could also be satisfied by an appropriate system training facility off
the aircraft.
(1) A side-by-side or over-under arrangement of large primary displays may integrate many air
data, attitude, navigation, alerting, and annunciation functions, while removing their discrete instrument
counterparts. For the initial approval of a new set of displays incorporating this arrangement, many of
the evaluation concepts covered elsewhere in this AMC must be adhered to, particularly those relating
to the use of colour and symbology for information separation (paragraph 5). The raw data aeroplane
parameters necessary for manual control (attitude, airspeed, altitude, and heading) must still reside in
a conventional basic T arrangement conducive to effective instrument crosscheck. This means that
heading and attitude must be presented on the same display for a side-by-side CRT arrangement.
(i) Air data displays have a requirement similar to attitude in that they must be able to convey to
the pilot a quick-glance sense of the present speed or altitude. Conventional round-dial moving pointer
displays inherently give some of this sense that may be difficult to duplicate on moving scales. Scale
length is one attribute related to this quick-glance capability. The minimum visible airspeed scale
length found acceptable for moving scales on jet transports has been 80 knots; since this minimum is
dependent on other scale attributes and aeroplane operational speed range, variations from this should
be verified for acceptability. Altimeters present special design problems in that –
(A) The ratio of total usable range to required resolution is a factor of 10 greater than for airspeed
or attitude, and
The combination of altimeter scale length and markings, therefore, should be adequate to allow
sufficient resolution for precise manual altitude tracking in level flight, as well as enough scale length
and markings to reinforce the pilot’s sense of altitude and to allow sufficient look-ahead room to
adequately predict and accomplish level-off. Addition of radio altimeter information on the scale so that
it is visually related to ground position may be helpful in giving low altitude awareness. Airspeed scale
markings that remain relatively fixed (such as stall warning, VMO/MMO), or that are configuration
dependent (such as flap limits), are desirable in that they offer the pilot a quick-glance sense of speed.
The markings should be predominant enough to confer the quick-glance sense information, but not so
predominant as to be distracting when operating normally near those speeds (e.g. stabilised approach
operating between stall warning and flap limit speeds).
(ii) Airspeed reference marks (bugs) on conventional airspeed indicators perform a useful
function, and the implementation of them on electronic airspeed displays is encouraged. Computed
airspeed/angle-of-attack reference marks (bugs) such as Vstall, Vstall warning, V1, VR, V2, flap limit
speeds, etc., displayed on the airspeed scale will be evaluated for accuracy. Provision should be
incorporated for a reference mark that will reflect the current target airspeed of the flight guidance
system. This has been required in the past for some systems that have complex speed selection
algorithms, in order to give the pilot adequate information required by CS 25.1309(c) for system
monitoring.
(iii) If any scale reference marks would not be available when equipment included on the MEL is
inoperative, then the display should be evaluated for acceptability both with and without these
reference marks.
2-GEN–17
CS-25 BOOK 2
(iv) Digital present value readouts or present value indices should not totally obscure the scale
markings or graduations as they pass the present value index.
(v) Adjacent scale markings that have potential for interfering with each other (such as V1, VR, V2
in close proximity) must be presented so that the intended reference values remain distinct and
unambiguous.
(vi) At the present time, scale units marking for air data displays incorporated into PFDs are not
required (‘knots’, ‘airspeed’ for airspeed, ‘feet’, ‘altitude’ for altimeters) as long as the content of the
readout remains unambiguous. For altimeters with the capability to display in both Metric and British
units, the scale and primary present value readout should remain scaled in British units with no units
marking required; the Metric display should consist of a separate present value readout that does
include units marking.
(vii) Airspeed scale graduations found to be acceptable have been in 5-knot increments with
graduations labelled at 20-knot intervals. If trend or acceleration cues are used, or a digital present
value readout is incorporated, scale markings at 10-knot intervals have been found acceptable.
Minimum altimeter graduations should be in 30 m (100-foot) increments with a present value readout,
or 15 m (50-foot) increments with a present value index only. Due to operational requirements, it is
expected that aeroplanes without either 20-foot scale graduations, or a readout of present value, will
not be eligible for Category II low visibility operation with barometrically determined decision heights.
(3) Vertically oriented moving scale airspeed indication is acceptable with higher numbers at the
top or bottom if no airspeed trend or acceleration cues are associated with the speed scale. Such cues
should be oriented so that increasing energy or speed results in upward motion of the cue. To be
consistent with this convention, airspeed scales with these cues should have the high-speed numbers
at the top. Speed, altitude, or vertical rate trend indicators should have appropriate hysteresis and
damping to be useful and non-distracting. Evaluation should include turbulence expected in service.
(4) The integration of many parameters into one upper display makes necessary an evaluation of
the effect of failure (either misleading or total loss) of a display at the most critical time for the pilot.
The sudden loss of multiple parameters can greatly impact the ability of the pilot to cope with
immediate aeroplane control tasks in certain flight regimes such as during take-off rotation. If such
failures are probable during the critical exposure time, the system must be evaluated for acceptability
of data lost to the pilot. Automatic sensing and switching may have to be incorporated to preserve a
display of attitude in one of the primary displays on the side with the failure.
e. Attitude
(1) An accurate, easy, quick-glance interpretation of attitude should be possible for all expected
unusual attitude situations and command guidance display configurations. The pitch attitude display
scaling should be such that during normal manoeuvres (such as take-off at high thrust-to-weight ratios)
the horizon remains visible in the display with at least 2° pitch margin available. * In addition, extreme
attitude symbology and automatically decluttering the EADI at extreme attitudes has been found
acceptable (extreme attitude symbology should not be visible during normal manoeuvring). Surprise,
unusual attitudes should be conducted in the aeroplane to confirm the quick-glance interpretation of
attitude. The attitude display should be examined in 360° of roll and ± 90° of pitch. This can usually
be accomplished by rotating the attitude source through the required gyrations with the aeroplane
powered on the ground. When the aeroplane hardware does not allow this type of evaluation, accurate
laboratory simulations must be used.
* See AMC 25.1303 (b)(5) paragraph 1.6
(2) Both fixed aeroplane reference and fixed earth reference bank pointers (‘sky’ pointers) have
been approved. A mix of these types in the same cockpit should not be approved.
2-GEN–18
BOOK 2 CS-25
The Agency has a long-standing policy of not accepting digital only displays of control parameters.
The reason was the belief that only analogue data in the form of a pointer/scale relationship provided
necessary rate, trend, and displacement information to the pilot. However, the Agency will evaluate
new electronic display formats, which include digital-only or combinations of digital and analogue
displays of air data, engine instruments, or navigation data. Digital information displays will be
evaluated on the basis that they can be used to provide the same or better level of performance and
pilot workload as analogue displays of the same parameters. Simulator studies can be valuable in
providing experience with new display formats, but care must be taken to ensure that the simulator
provides all the environmental cues germane to the parameter being evaluated.
(1) Control knobs used to set digital data on a display that have inadequate friction or tactile
detents can result in undue concentration being required for a simple act such as setting an out-of-view
heading bug to a CRT displayed number. Controls for this purpose should have an appropriate
amount of feel to minimise this problem, as well as minimising the potential for inadvertent changes.
The friction levels associated with standard resistive potentiometers have been shown in some cases
to be inadequate.
(2) The display response to control input need not meet the dynamic requirements of paragraph
6.e., but should be fast enough to prevent undue concentration being required in setting values or
display parameters. The sense of motion of controls should comply with the requirements of CS
25.777, where applicable.
Some aeroplane parameters or status indications are required by the CS-25 and operational
regulations to be displayed; yet they may only be necessary or required in certain phases of flight. If it
is desired to inhibit some parameters from full-time display, an equivalent level of safety to full-time
display must be demonstrated. Criteria to be considered include the following:
(1) Continuous display of the parameter is not required for safety of flight in all normal flight
phases.
(3) The inhibited parameter is automatically displayed when its value indicates an abnormal
condition, or when the parameter reaches an abnormal value.
(4) Display of the inhibited parameter can be manually selected by the crew without interfering
with the display of other required information.
(5) If the parameter fails to be displayed when required, the failure effect and compounding effects
must meet the requirements of CS 25.1309.
(6) The automatic, or requested, display of the inhibited parameter should not create
unacceptable clutter on the display; simultaneous multiple ‘pop-ups’ must be considered.
(7) If the presence of the new parameter is not sufficiently self-evident, suitable alerting must
accompany the automatic presentation.
Switching and annunciation considerations made important by electronic displays are as follows:
2-GEN–19
CS-25 BOOK 2
(1) The electronic attitude display should not be unusable or unstable for more than one second
after the normally expected electrical bus transients due to engine failure, and should affect only
displays on one side of the aeroplane. Recognisably valid pitch and roll data should be available
within one second, and any effects lasting beyond one second should not interfere with the ability to
obtain quick-glance attitude. For most aeroplanes an engine failure after take-off will simultaneously
create a roll rate acceleration, new pitch attitude requirements, and an electrical transient. Attitude
information is paramount; transfer to standby attitude or transfer of control of the aeroplane to the other
pilot cannot be reliably accomplished under these conditions in a timely enough manner to prevent an
unsafe condition. In testing this failure mode, experience has shown that switching the generator off at
the control panel may not result in the largest electrical transient. During an engine failure, as the
engine speed decays, the generator output voltage and frequency each decay to a point where the bus
control finally recognises the failure. This can be a significantly larger disturbance resulting in a
different effect on the using equipment. One practical way to simulate this failure is with a fuel cut.
Other engine failure conditions may be more critical (such as sub-idle stalls) which cannot be
reasonably evaluated in flight test. Analysis should identify these failure modes and show that the
preceding criteria are met.
(2) The design objective should be displays that are insensitive to power transients; however, if
the power transient is not related to a simultaneous aeroplane control problem, other failures which
result in loss of displays on one side are not deemed as time critical, providing the switching concepts
for multiple parameter displays are considered (paragraph 7.d.). Bus transients caused by normal load
switching (hydraulic pump actuation, ovens, generator paralleling, etc.) should cause no visible effect
on the display. Expected abnormal bus transients (i.e. generator failure not caused by engine failure)
should not initiate a power up initialisation or cold start process.
(3) The large electrical loads required to restart some engine types should not affect more than
one pilot’s display.
(1) The acceptability of a so-called ‘cruise’ mode in which the upper EADI and lower EHSI display
formats may be transposed will be considered on a case-by-case basis by the Agency.
(2) In case of a symbol generator failure, both the pilot’s and the co-pilot’s displays may be driven
from a single remaining symbol generator. When this switching state is invoked, there should be clear,
cautionary alerting to both pilots that the displayed information is from a single source.
When the type or source of information presented on the primary flight instruments can change
meaning with manual or automatic mode or source selection, then this mode or source must be
inherently unambiguous from the format of the display or from appropriate annunciation.
(1) Independent attitude, heading, and air data sources are required for the pilot and co-pilot
primary displays. As long as independent sources are selected, there would ordinarily be no need for
annunciation of these sources. If sources to the electronic displays can be switched in such a fashion
that the flight crew becomes vulnerable to hazardously misleading information on both sides of the
cockpit as a result of a common failure, then this switching configuration should be accomplished by a
cautionary alert in clear view of both pilots.
(2) If the source of navigation information is not ambiguous, such as a case when VOR/ILS is not
switchable across the cockpit, then no source annunciation would be required. Likewise, if a single
navigation computer could only be responsible for the HSI navigation data, then this source need not
be annunciated.
2-GEN–20
BOOK 2 CS-25
(3) If a crew member can select from multiple, similar, navigation sources, such as multiple VORs
or multiple, long-range navigation systems, then the display of the selected source data into a CDI type
presentation should be annunciated (i.e. VOR 1, INS 2, etc.). The annunciation should be
implemented in such a fashion that a non-normal source selection is immediately apparent. In
addition, when both crewmembers have selected the same navigation source, this condition should be
annunciated; for example, the co-pilot has offside VOR selected, with VOR 1 annunciated in
amber/yellow in the co-pilot’s electronic display. Exceptions to this non-normal annunciation
requirement can be constructed. If the similar navigation sources are two navigation computers that
ensure position and stored route identically through a cross-talk channel, electronic display of normal
or non-normal source annunciation would not be required provided a system disparity was
annunciated. In the case where source annunciations are not provided on the electronic displays, such
source annunciations should be readily obvious to the crew.
(4) The increased flexibility offered by modern avionics systems may cause flightcrews to be more
susceptible to selecting an inappropriate navigation source during certain phases of flight, such as
approach. Since electronic displays may incorporate more complex switching, compensating means
should be provided to ensure that the proper navigation source has been selected. In order to reduce
the potential for the pilot selecting a non-approach-qualified navigation source (such as INS) for an
instrument approach, the Agency has approved the use of a discrete colour, in addition to labelling, for
data from non-approach-qualified navigation sources when displayed on a CDI.
(5) If the primary heading display can be presented as true or grid heading or track –
(i) The electronic display should provide appropriate annunciation. Annunciation of magnetic
heading is not normally required.
(ii) Either the display or heading source should provide a cautionary alert to the crew prior to entry
into a terminal area with other than magnetic heading displayed. Examples of acceptable
implementations include a simple alert when below 3048 m (10 000 feet) and in true heading mode, or
a display alert generated by complex logic that detects the initiation of a descent from cruise altitude
while still in true heading mode.
(6) There are situations where it may be desirable to have true heading displayed on the primary
navigation display, and at the same time have VOR or ADF bearing pointers visible. All but a very
small fraction of the VORs are referenced to Magnetic North; the electronic display should display the
bearing pointer in such a fashion that it will point geometrically correct. If other display considerations
permit, a separate readout of magnetic bearing to the VOR station would be desirable. If the electronic
display cannot display this ‘corrected’ geometric bearing, then some display attribute should make it
clear to the flight crew that the displayed geometry is not correct.
(7) Mode and source select annunciations on electronic displays should be compatible (this does
not mean that the labels have to be identical, but that they are unambiguous in being able to identify
them as the same function) with labels on source and mode select switches and buttons located
elsewhere in the cockpit.
(8) If annunciation of automatic navigation system or flight control system mode switching is
provided by the electronic display, selected modes should be clearly annunciated with some inherent
attention-getting feature, such as a temporary box around the annunciation. Examples include vertical
or lateral mode capture, release of capture, and autopilot or autothrottle mode change.
d. Failures
In the case of a detected failure of any parameter, the associated invalid indications should be
removed and only the flag should be displayed. It is recommended that differentiation be made
between the failure of a parameter and a ‘no computed data’ parameter, e.g. non-reception of radio
navigation data.
2-GEN–21
CS-25 BOOK 2
a. The map format should provide features recommended by SAE Document ARP 1068B.
Evaluation of maps or navigation displays overlaid with raster radar returns should ensure that all
essential map or navigation display symbology remains readable and easily discriminated from the
radar data.
b. When a route or course line can be presented in a map format, it should be demonstrated that
the route can be flown manually and with autopilot in heading hold or control wheel steering modes (if
applicable) with course errors compatible with those course errors defined as allowable in EUROCAE
DOCUMENT ED 58. ED 58 discusses flight technical error and relates methods of accounting for
piloting accuracy.
c. If instrument approaches are to be flown using a map format, previous certifications have
included an AFM limitation requiring at least one pilot to monitor a raw data presentation. For ILS
approaches, raw localiser and glide slope deviation presented in the ADI has been sufficient, and both
navigation displays may remain in the map mode. For VOR approaches, a map course line may be
used as the primary display for conducting the approach, providing the AFM limitations prescribe the
allowable display mode configurations for proper raw data monitoring. Additional considerations
include evaluation of crew time and task demands to configure the map/navigation computer for the
approach. If it is desired to have both displays in the map mode for VOR approaches with no raw data
monitoring, the accuracy and failure modes of the map display, navigation computer, and sensors must
be shown to be compatible with the performance requirements and obstacle clearance zones
associated with the type of approach being conducted.
d. When evaluating map failure modes, including failures induced by the symbol generator or the
source navigation computer, consideration must be given to the compelling nature of a map display. It
has been demonstrated that gross map position errors can go undetected or disbelieved because the
flight crew falsely relied on the map instead of correct raw data. This characteristic of crew
interpretation reinforces the need to adhere to the criteria of paragraph 4a(3)(viii), (which defines
navigation as an essential function) when considering equipment and navigation source requirements.
b. Caution and warning displays are necessarily related to aural alerts and master caution and
warning attention-getting devices. If the electronic display provides caution and warning displays,
previously independent systems may be integrated into one system where single faults potentially may
result in the loss of more than one crew alerting function. Integrated systems have been found to be
satisfactory if the features outlined below are provided –
(1) Visual and aural master caution attention-getting devices are activated whenever a caution
message is displayed. Different visual and aural master warning devices are provided which activate
whenever a warning is displayed.
2-GEN–22
BOOK 2 CS-25
(2) An aural alert audible to all flight crew members under all expected operating conditions is
sounded when any conditions exist that require crew recognition of a problem and either immediate or
future action. If the aural alert occurs because of the landing gear configuration warning, overspeed
warning, take-off configuration warning, or ground proximity warning, the aural alert must sound
continually while the conditions exist. The landing gear configuration warning may be automatically
inhibited in those flight regimes where the warning is clearly unnecessary. Special means may be
provided to cancel these aural warnings during selected non-normal procedures. If any one warning is
cancelled, the remaining warnings must still be available. Other aural alerts may be cancelled by the
flight crew. Certain alerts (either the aural portion or both aural and visual) may be inhibited in limited
phases of flight, and enabled when that phase of flight is exited or terminated, provided the overall
inhibition scheme increases safety. For example, systems have been approved that inhibit most alerts
during (and immediately after) the take-off. The safety objective is to reduce the incidence of
unnecessary high-speed rejected take-offs (RTO). Toward this end, the more effective type of system
uses airspeed sensing to automatically begin the inhibit function. Systems requiring manual inhibition
prior to initiation of take-off have been approved, but have the undesirable effect of suppressing alerts
that should properly instigate a low-speed RTO. Enabling of alerts should be automatic after an
altitude gain appropriate to the type of aeroplane.
(3) A separate and distinct visual warning, caution, or advisory message is conspicuously
displayed for each warning, caution, or advisory condition that the system is designed to recognise.
The visual indication must be visible by all flight crew members under all expected lighting conditions.
The colours of visual warning, caution, and advisory displays provided by this system must comply with
CS 25.1322.
(4),(5) & (6) Reliability and Integrity (see AMC 25.1322, 8).
(7) The aural alerting is audible to the flight crew under worst-case ambient noise conditions, but
not so loud and intrusive as to interfere with the crew taking the required action to ensure safe flight.
a. For purposes of the following discussion, checklist displays are divided into three types: those
modifiable by the flight crew, those modifiable only on the ground by maintenance procedure, and
those containing information ‘hardwired’ into the system or in ROM (unchangeable read-only-memory).
(1) Data modifiable by the flight crew. The responsibility for electronic checklist display contents
rests with the flight crew. For those operations where the aeroplane is commonly flown by the same
flight crew every day, this responsibility presents no burden on the pilots. At the other extreme, in an
air carrier operation the pilots cannot be reasonably expected to review the contents of the checklist
before their first flight of the day in that aeroplane. In order to implement this type of operation, the
checklist format should allow for some means to easily determine the current status of the information;
this means should be compatible with a practically implemented procedure that operationally controls
who makes changes, and when and how that change level is identified on the display.
(2) Data modifiable by maintenance procedure. The display system should lend itself to a means
for the flight crew to easily determine the change level of the checklist contents.
(3) Data prepared by the manufacturer and contained in ROM. It has been previously stated in
the section on display criticality that the display of hazardously misleading flight crew procedures must
be Improbable. This requirement applies not only to failure states of the display system, but also to
changes to the aeroplane after display certification. While it is the responsibility of the manufacturer
and the Agency to provide acceptable procedures to the operator, it is the responsibility of the operator
to identify any checklist changes that may be made necessary by aeroplane modification. The display
manufacturer should design the system so that revision status is easily identifiable by, and such that
required changes can be made available to, the operator. An aeroplane change that made the
electronic checklist incompatible with the required crew procedures in a manner that could be
2-GEN–23
CS-25 BOOK 2
hazardously misleading would require the corresponding change to be made to the checklist or the
display to be disabled entirely.
b. The wide variety of configurations and corresponding AFM supplements within a single model
may establish a unique set of checklist procedures for each individual aeroplane. Incorporation of
STCs or other minor modifications could necessitate changes to the AFM, AFM supplements, or
addition of new supplements. These changes would then require modifications to the electronically
displayed checklists. At this stage of display development, it would seem advisable to limit displayed
checklist information to that which can easily be changed or that which pertains only to the basic
aeroplane. A hard copy of the AFM or approved operations manual and any checklists required by the
operational rules must be available to the flight crew at all times.
d. Electronic checklists should be consistent in the level of detail among the various procedures.
Checklist content that the crew may rely on for normal day-to-day procedures, but which is incomplete
for abnormal or emergency procedures, may be unsatisfactory because of the extra time required for
the crew to discover that the information required is missing and only obtainable from an alternate
hard-copy checklist. Crew training, display response time, availability of display, and other cockpit
cues are to be considered in evaluating the display system. If the system does not display all
procedures required for safe operation of the aeroplane during normal and emergency conditions,
testing is required to ensure that the proposed method for integrating an electronic checklist along with
hard copy checklists does not decrease the level of safety in any foreseeable circumstance. If
electronic checklists are installed, pilot workload should be no greater than that for using hard copy of
the procedures.
If aeroplane systems status displays are provided, based on flight phase and system failure conditions,
the symbols representing the system components should be logical, easily understood, and consistent
between display formats. The colours used should be compatible with the requirements of paragraphs
5.a. and 5.b. of this AMC.
2-GEN–24
BOOK 2 CS-25
AMC 25-13
Reduced And Derated Take-Off Thrust (Power) Procedures
1 Purpose
This acceptable means of compliance (AMC) provides guidance for the certification and use of reduced
thrust (power) for take-off and derated take-off thrust (power) on turbine powered transport category
aeroplanes. It consolidates CS guidance concerning this subject and serves as a ready reference for
those involved with aeroplane certification and operation. These procedures should be considered
during aeroplane type certification and supplemental type certification activities when less than engine
rated take-off thrust (power) is used for take-off.
3 Background
Take-off operations conducted at thrust (power) settings less than the maximum take-off thrust (power)
available may provide substantial benefits in terms of engine reliability, maintenance, and operating
costs. These take-off operations generally fall into two categories; those with a specific derated thrust
(power) level, and those using the reduced thrust (power) concept, which provides a lower thrust
(power) level that may vary for different take-off operations. Both methods can be approved for use,
provided certain limitations are observed. The subjects discussed herein do not pertain to in-flight
thrust cutback procedures that may be employed for noise abatement purposes.
4 Definitions
Customarily, the terms ‘thrust’ and ‘power’ are used, respectively, in reference to turbojet and
turboprop installations. For simplicity, only the term ‘thrust’ is used throughout this AMC. For
turboprop installations, the term ‘power’ should be substituted. For purposes of this AMC the following
definitions apply:
a. Take-off Thrust
(1) Rated take-off thrust, for a turbojet engine, is the approved engine thrust, within the operating
limits, including associated time limits, established by the engine type certificate for use during take-off
operations.
(2) Take-off thrust, for an aeroplane, is normally the engine rated take-off thrust, corrected for any
installation losses and effects that is established for the aeroplane under CS-25. Some aeroplanes
use a take-off thrust setting that is defined at a level that is less than that based on the engine rated
take-off thrust. CS 25.1521 requires that the take-off thrust rating established for the aeroplane must
not exceed the take-off thrust rating limits established for the engine under the engine type certificate.
The value of the take-off thrust setting parameter is presented in the Aeroplane Flight Manual (AFM)
and is considered a normal take-off operating limit.
b. Derated take-off thrust, for an aeroplane, is a take-off thrust less than the maximum take-off
thrust, for which exists in the AFM a set of separate and independent, or clearly distinguishable, take-off
limitations and performance data that complies with all the take-off requirements of CS-25. When
operating with a derated take-off thrust, the value of the thrust setting parameter, which establishes
thrust for take-off, is presented in the AFM and is considered a normal take-off operating limit.
c. Reduced take-off thrust, for an aeroplane, is a take-off thrust less than the take-off (or derated
take-off) thrust. The aeroplane take-off performance and thrust setting are established by approved
2-GEN–25
CS-25 BOOK 2
simple methods, such as adjustments, or by corrections to the take-off or derated take-off thrust setting
and performance. When operating with a reduced take-off thrust, the thrust setting parameter, which
establishes thrust for take-off, is not considered a take-off operating limit.
e. A contaminated runway is a runway where more than 25% of the required field length, within
the width being used, is covered by standing water or slush more than 3·2 mm (0·125 inch) deep, or
that has an accumulation of snow or ice. However, in certain other situations it may be appropriate to
consider the runway contaminated. For example, if the section of the runway surface that is covered
with standing water or slush is located where rotation and lift-off will occur, or during the high speed
part of the take-off roll, the retardation effect will be far more significant than if it were encountered
early in the take-off while at low speed. In this situation, the runway might better be considered
‘contaminated’ rather than ‘wet’.
Under CS 25.101(c), 25.101(f), and 25.101(h), it is acceptable to establish and use a take-off thrust
setting that is less than the take-off or derated take-off thrust if –
(1) Does not result in loss of systems or functions that are normally operative for take-off such as
automatic spoilers, engine failure warning, configuration warning, systems dependent on engine bleed
air, or any other required safety related system.
(2) Is based on an approved take-off thrust rating or derating for which complete aeroplane
performance data is provided.
(3) Enables compliance with the applicable engine operating and aeroplane controllability
requirements in the event that take-off thrust, or derated take-off thrust (if such is the performance
basis), is applied at any point in the take-off path.
(4) Is at least 75% of the take-off thrust, or derated take-off thrust if such is the performance basis, for
the existing ambient conditions, with no further reduction below 75% resulting from ARP credit.
(6) Enables compliance with CS-25 Appendix I in the event of an engine failure during take-off, for
aeroplanes equipped with an Automatic Reserve Performance system.
b. Relevant speeds (VEF, VMC, VR, and V2) used for reduced thrust take-offs are not less than
those which will comply with the required airworthiness controllability criteria when using the take-off
thrust (or derated take-off thrust, if such is the performance basis) for the ambient conditions, including
the effects of an Automatic Reserve Performance (ARP) system. It should be noted, as stated in
paragraph c. below, that in determining the take-off weight limits, credit can be given for an operable
ARP system.
c. The aeroplane complies with all applicable performance requirements, including the criteria in
paragraphs a. and b. above, within the range of approved take-off weights, with the operating engines
at the thrust available for the reduced thrust setting selected for take-off. However, the thrust settings
used to show compliance with the take-off flight path requirements of CS 25.115 and the final take-off
climb performance requirements of CS 25.121(c) should not be greater than that established by the
initial thrust setting. In determining the take-off weight limits, credit can be given for an operable ARP
system.
2-GEN–26
BOOK 2 CS-25
d. Appropriate limitations, procedures, and performance information are established and are
included in the AFM. The reduced thrust procedures must ensure that there is no significant increase
in cockpit workload, and no significant change to take-off procedures.
e. A periodic take-off demonstration is conducted using the aeroplane’s take-off thrust setting
without ARP, if fitted, and the event is logged in the aeroplane’s permanent records. An approved
engine maintenance procedure or an approved engine condition-monitoring programme may be used
to extend the time interval between take-off demonstrations.
f. The AFM states, as a limitation, that take-offs utilising reduced take-off thrust settings –
(1) Are not authorised on runways contaminated with standing water, snow, slush, or ice, and are
not authorised on wet runways unless suitable performance accountability is made for the increased
stopping distance on the wet surface.
(2) Are not authorised where items affecting performance cause significant increase in crew workload.
Inoperative Equipment: Inoperative engine gauges, reversers, anti-skid systems or engine systems
resulting in the need for additional performance corrections.
Engine Intermix: Mixed engine configurations resulting in an increase in the normal number of power
setting values.
(3) Are not authorised unless the operator establishes a means to verify the availability of take-off
or derated take-off thrust to ensure that engine deterioration does not exceed authorised limits.
(4) Are authorised for aeroplanes equipped with an ARP System, whether operating or not.
(1) Application of reduced take-off thrust in service is always at the discretion of the pilot.
(2) When conducting a take-off using reduced take-off thrust, take-off thrust or derated take-off
thrust if such is the performance basis may be selected at any time during the take-off operation.
h. Procedures for reliably determining and applying the value of the reduced take-off thrust
setting and determining the associated required aeroplane performance are simple (such as the
assumed temperature method). Additionally, the pilot is provided with information to enable him to
obtain both the reduced take-off thrust and take-off thrust, or derated take-off thrust if such is the
performance basis, for each ambient condition.
i. Training procedures are developed by the operator for the use of reduced take-off thrust.
For approval of derated take-off thrust provisions, the limitations, procedures, and other information
prescribed by CS 25.1581, as applicable for approval of a change in thrust, should be included as a
separate Appendix in the AFM. The AFM limitations section should indicate that when operating with
derated thrust, the thrust setting parameter should be considered a take-off operating limit. However,
in-flight take-off thrust (based on the maximum take-off thrust specified in the basic AFM) may be used
in showing compliance with the landing and approach climb requirements of CS 25.119 and 25.121(d),
provided that the availability of take-off thrust upon demand is confirmed by using the thrust-verification
checks specified in paragraph 5.e. above.
2-GEN–27
CS-25 BOOK 2
AMC 25–19
Certification Maintenance
Requirements
1 PURPOSE
This AMC is similar to FAA Advisory Circular AC 25–19 dated 28 November 1994.
This Acceptable Means of Compliance (AMC) provides guidance on the selection, documentation and
control of Certification Maintenance Requirements (CMRs). For those aeroplanes whose initial
maintenance programme is developed under the Maintenance Review Board (MRB) process, this
document also provides a rational basis for coordinating the Maintenance Review Board (MRB) and
CMR selection processes in order to minimise the impact of CMRs on aeroplane operators. It is
recognised that, for those aeroplanes whose initial maintenance programme is developed under a
different process, the coordination and documentation aspects have to be adapted to the particular
case. Like all acceptable means of compliance, this AMC is not, in itself, mandatory, and does not
constitute a requirement. It is issued to describe an acceptable means, but not the only means, for
selecting, documenting and managing CMRs. Terms such as ‘shall’ and ‘must’ are used only in the
sense of ensuring applicability of this particular method of compliance when the acceptable method of
compliance described herein is used.
3 RELATED DOCUMENTS
4 BACKGROUND
CMRs have been in use since the early 1970’s, when the industry began using quantitative approaches
to certify systems to the requirements of CS 25.1309 and other requirements requiring safety analyses.
CMRs have been established on several aeroplanes certified in Europe and in other countries, and are
being planned for use on aeroplanes currently under development.
5 CMR DEFINITION
A CMR is a required periodic task, established during the design certification of the aeroplane as an
operating limitation of the type certificate. CMRs are a subset of the tasks identified during the type
certification process. CMRs usually result from a formal, numerical analysis conducted to show
compliance with Catastrophic and Hazardous Failure Conditions as defined in paragraph 6b, below.
There are two types of CMRs, as defined in paragraph 12 of this AMC.
2-GEN–28
BOOK 2 CS-25
a. A CMR is intended to detect safety-significant latent failures which would, in combination with
one or more other specific failures or events, result in a Hazardous or Catastrophic Failure Condition.
b. It is important to note that CMRs are derived from a fundamentally different analysis process
than the maintenance tasks and intervals which result from Maintenance Steering Group (MSG–3)
analysis associated with Maintenance Review Board (MRB) activities. MSG–3 analysis activity
produces maintenance tasks which are performed for safety, operational, or economic reasons,
involving both preventative maintenance tasks, which are performed before failure occurs (and are
intended to prevent failures), as well as failure-finding tasks. CMRs, on the other hand, are failure-
finding tasks only, and exist solely to limit the exposure to otherwise hidden failures. Although CMR
tasks are failure-finding tasks, use of potential failure-finding tasks, such as functional checks and
inspections, may also be appropriate.
c. CMRs are designed to verify that a certain failure has or has not occurred, and do not provide
any preventative maintenance function. CMRs ‘restart the failure clock to zero’ for latent failures by
verifying that the item has not failed, or cause repair if it has failed. Because the exposure time to a
latent failure is a key element in the calculations used in a safety analysis performed to show
compliance with CS 25.1309, limiting the exposure time will have a significant effect on the resultant
overall failure probability of the system. The CMR task interval should be designated in terms of flight
hours, cycles, or calendar time, as appropriate.
d. The type certification process assumes that the aeroplane will be maintained in a condition or
airworthiness at least equal to its certified or properly altered condition. The process described in this
AMC is not intended to establish normal maintenance tasks that should be defined through the MSG–3
analysis process. Also, this process is not intended to establish CMRs for the purpose of providing
supplemental margins of safety for concerns arising late in the type design approval process. Such
concerns should be resolved by appropriate means, which are unlikely to include CMRs not
established via normal safety analyses.
e. CMRs should not be confused with required structural inspection programmes, which are
developed by the type certificate applicant to meet the inspection requirements for damage tolerance,
as required by CS 25.571 or CS 25.1529, Appendix H25.4 (Airworthiness Limitations section). CMRs
are to be developed and administered separately from any structural inspection programmes.
6 OTHER DEFINITIONS
The following terms apply to the system design and analysis requirements of CS 25.1309(b), (c), and
(d), and the guidance material provided in this AMC. For a complete definition of these terms, refer to
the applicable requirements and guidance material, (i.e. AC 25.1309–1A and/or the EASA Acceptable
Means of Compliance AMC 25.1309-1). AC 25.1309–1A and AMC 25.1309-1 are periodically revised
by the FAA/EASA and are the controlling documents for definition of these terms. The terms listed
below are derived from this guidance material and are included to assist in the use of this document.
a. Failure
b. Failure Condition
The effect on the aeroplane and its occupants, both direct and consequential, caused or contributed to
by one or more failures, considering relevant adverse operational or environmental conditions. Failure
Conditions may be classified according to their severities as follows:
(1) Minor Failure Conditions: Failure Conditions which would not significantly reduce aeroplane
safety, and which involve crew actions that are well within their capabilities. Minor Failure Conditions
2-GEN–29
CS-25 BOOK 2
may include, for example, a slight reduction in safety margins or functional capabilities, a slight
increase in crew workload, such as routine flight plan changes, or some inconvenience to occupants.
(2) Major Failure Conditions: Failure Conditions which would reduce the capability of the
aeroplane or the ability of the crew to cope with adverse operating conditions to the extent that there
would be, for example, a significant reduction in safety margins or functional capabilities, a significant
increase in crew workload or in conditions impairing crew efficiency, or discomfort to occupants,
possibly including injuries.
(3) Hazardous Failure Conditions: Failure Conditions, which would reduce the capability of the
aeroplane or the ability of the crew to cope with adverse operating, conditions to the extent that there
would be:
(ii) physical distress or higher workload such that the flight crew cannot be relied upon to perform
their tasks accurately or completely, or
(4) Catastrophic Failure Conditions: Failure Conditions, which would prevent the continued safe
flight and landing of the aeroplane.
When using qualitative or quantitative assessments to determine compliance with CS 25.1309(b), the
following descriptions of the probability terms used in the requirement and in the acceptable means of
compliance listed above have become commonly accepted aids to engineering judgement:
(1) Probable Failure Conditions: Probable Failure Conditions are those anticipated to occur one or
more times during the entire operational life of each aeroplane. Probable Failure Conditions are those
having a probability of the order of 1 x 10–5 or greater. Minor Failure Conditions may be probable.
(2) Improbable Failure Conditions: Improbable Failure Conditions are divided into two categories
as follows:
(i) Remote: Unlikely to occur to each aeroplane during its total life but may occur several times
when considering the total operational life of a number of aeroplanes of the same type. Improbable
(Remote) Failure Conditions are those having a probability of the order of 1 x 10–5 or less, but greater
than of the order of 1 x 10–7. Major Failure Conditions must be no more frequent than Improbable
(Remote).
(ii) Extremely Remote. Unlikely to occur when considering the total operational life of all
aeroplanes of the same type, but nevertheless has to be considered as being possible. Improbable
(Extremely Remote) Failure Conditions are those having a probability of the order of 1 x 10–7 or less,
but greater than of the order of 1 x 10–9. Hazardous Failure Conditions must be no more frequent than
Improbable (Extremely Remote).
(3) Extremely Improbable Failure Conditions: Extremely Improbable Failure Conditions are those
so unlikely that they are not anticipated to occur during the entire operational life of all aeroplanes of
one type, and have a probability of the order of 1 x 10–9 or less. Catastrophic Failure Conditions must
be shown to be Extremely Improbable.
2-GEN–30
BOOK 2 CS-25
d. Qualitative
Those analytical processes that assess system and aeroplane safety in a subjective, non-numerical
manner, based on experienced engineering judgement.
e. Quantitative
Those analytical processes that apply mathematical methods to assess system and aeroplane safety.
CS 25.1309(b) provides general requirements for a logical and acceptable inverse relationship
between the probability and severity of each Failure Condition, and CS 25.1309(d) requires that
compliance be shown primarily by analysis. In recent years there has been an increase in the degree
of system complexity and integration, and in the number of safety-critical functions performed by
systems. This increase in complexity has led to the use of structured means for showing compliance
with the requirements of CS 25.1309.
a. CS 25.1309(b) and (d) specify required safety levels in qualitative terms, and require that a
safety assessment be made. Various assessment techniques have been developed to assist applicants
and the Agency in determining that a logical and acceptable inverse relationship exists between the
probability and the severity of each Failure Condition. These techniques include the use of service
experience data of similar, previously approved systems, and thorough qualitative analyses.
b. In addition, difficulties have been experienced in assessing the acceptability of some designs,
especially those of systems, or parts of systems, that are complex, that have a high degree of
integration, that use new technology, or that perform safety-critical functions. These difficulties led to
the selective use of rational analyses to estimate quantitative probabilities, and the development of
related criteria based on historical data of accidents and hazardous incidents caused or contributed to
by failures. These criteria, expressed as numerical probability ranges associated with the terms used in
CS 25.1309(b), became commonly accepted for evaluating the quantitative analyses that are often
used in such cases to support experienced engineering and operational judgement and to supplement
qualitative analyses and tests.
NOTE: See Acceptable Means of Compliance 25.1309, System Design and Analysis, for a complete description of the
inverse relationship between the probability and severity of Failure Conditions, and the various methods of showing
compliance with CS 25.1309.
A decision to create a candidate CMR should follow the guidelines given in AMC 25.1309-1 (i.e. the
use of candidate CMRs in lieu of practical and reliable failure monitoring and warning systems to detect
significant latent failures when they occur does not comply with CS 25.1309(c) and (d)(4). A practical
failure monitoring and warning system is one, which is considered to be within the state of the art. A
reliable failure monitoring and warning system is one, which would not result in either excessive
failures of a genuine warning, or excessive or untimely false warnings, which can sometimes be more
hazardous than lack of provision for, or failures of, genuine but infrequent warnings. Experienced
judgement should be applied when determining whether or not a failure monitoring and warning system
would be practical and reliable. Comparison with similar, previously approved systems is sometimes
helpful. Appendix 1 outlines some design considerations that should be observed in any decision to
create a candidate CMR.
2-GEN–31
CS-25 BOOK 2
a. Figure 1 illustrates the relationship between the certification process and the MRB process in
establishing scheduled maintenance tasks. Those tasks related to the certification process, as well as
those derived through MSG–3 analysis, must be identified and documented as illustrated. The details
of the process to be followed in defining, documenting, and handling CMRs are given in paragraphs 9b
through 12 below.
b. Candidate CMRs
(1) Tasks that are candidates for selection as CMRs usually come from safety analyses (e.g.
System Safety Assessments (SSA), which may establish the need for tasks to be carried out
periodically to comply with CS 25.1309 and other requirements requiring this type of analysis). Tasks
may be selected from those intended to detect latent failures, which would, in combination with one or
more specific failures or events, lead to a Hazardous or Catastrophic Failure Condition.
(2) Other tasks, not derived from formal safety analyses but based on properly justified
engineering judgement, may also be candidates for CMRs. The justification must include the logic
leading to identification as a candidate CMR, and the data and experience base supporting the logic.
b. As early as possible in the design phase of the aeroplane programme, and at intervals as
necessary, the CMCC should meet to review candidate CMRs, their purpose, criticality, and other
relevant factors. During the CMCC’s discussions, participants’ experience may suggest alternatives to
a given CMR, which would satisfy the intent of the CMR, while allowing reduced operational impact. In
addition, where multiple tasks result from a quantitative analysis, it may be possible to extend a given
interval at the expense of one or more other intervals, in order to optimise the required maintenance
activity. However, if a decision is made to create a CMR, then the CMR task interval shall be based
solely on the results of the safety analysis.
c. The CMCC would function as an advisory committee for the TC applicant. The results of the
CMCC (proposed CMRs to be included on the type design definition and proposed revisions to MRB
tasks and/or intervals) would be forwarded by the TC applicant to the ISC for their consideration.
Revisions to proposed MRB tasks and/or intervals accepted by the ISC will be reflected in the MRB
report proposal. Revisions to proposed MRB tasks and/or intervals rejected by the ISC will result in
CMR tasks. Subsequent to the ISC’s consideration, the TC applicant will submit the CMR document, as
defined in paragraph 12 of this AMC, to the Agency for final review and approval.
11 SELECTION OF CMRs
a. The candidate CMRs should be reviewed by the CMCC and a determination made as to
whether or not CMR status is necessary and, if so, whether to categorise the CMR as One Star or Two
Star, as defined in paragraph 12 of this AMC. To reach this decision, the following should be
considered by the CMCC:
(1) CMR status does not need to be applied if the CCMR is satisfied by:
2-GEN–32
BOOK 2 CS-25
(i) Maintenance actions considered to be routine maintenance activity (and which are also
identified as MRB tasks) based on engineering judgement and experience on similar aeroplane types,
or
(2) CMRs remaining after application of paragraph 11a(1) should be categorised as either One
Star or Two Star CMRs. The following should be considered in assigning One Star or Two Star status:
(i) The degree of conservatism taken in the classification of the Failure Condition consequences.
(ii) The degree of conservatism taken in the individual failure rates and event occurrence rates
used.
(iii) The margin between safety analysis calculated maximum interval and the interval selected
through the MRB process.
(v) The proximity of the calculated maximum interval to the aeroplane life.
b. For operators with approved escalation practices or an approved reliability programme, data
collection and analytical techniques are used to make adjustments to an operator’s maintenance
programme. It has been demonstrated that the management of a maintenance programme does not
give rise to undue escalations. Therefore, escalation of Two Star CMR task intervals within an
operator’s maintenance programme ensures that Two Star CMRs will be properly managed by the
operator with adequate controls.
CMRs should be listed in a separate CMR document, which is referenced in the Type Certificate Data
Sheet. The latest version of the CMR document should be controlled by a EASA-approved log of
pages. In this way, changes to CMRs following certification will not require an amendment to the Type
Certificate Data Sheet. The CMR document should clearly identify the two types of CMR tasks, which
are handled as follows:
a. One Star CMRs (*) – The tasks and intervals specified are mandatory and cannot be changed,
escalated, or deleted without the approval of the Agency.
b. Two Star CMRs (**) – Task intervals may be adjusted in accordance with an operator ’s
approved escalation practices or an approved reliability programme, but the task may not be changed
or deleted without prior Agency approval.
c. All minimum initial scheduled maintenance tasks, and CMRs, should reside in an MRB report to
ensure that the operator’s maintenance planning personnel are aware of all requirements. The CMR
document should be included as Appendix 1 or A (the first appendix) to the MRB report. The MRB report
should include a note indicating that the CMR document is the controlling document for all CMR tasks.
When a CMR task corresponds to an MRB task, whatever the respective intervals, this fact should be
highlighted, for example, by flagging the task in the CMR appendix of the MRB report.
d. Since CMRs are based on statistical averages and reliability rates, an exceptional short-term
extension for a single CMR interval may be made on one aeroplane for a specific period of time without
jeopardising safety. Any extensions to CMR intervals (both one star and two star) must be defined and
fully explained in the CMR document. The local authority must be notified as soon as practicable if any
short-term extension allowed by the CMR document has taken place.
2-GEN–33
CS-25 BOOK 2
(1) The term ‘exceptional short-term extension’ is defined as an increase in a CMR interval which
may be needed to cover an uncontrollable or unexpected situation. Any allowable increase must be
defined either as a percent of the normal interval, or a stated number of flight hours, flight cycles, or
calendar days. If no short-term extension is to be allowed for a given CMR, this restriction should be
stated in the CMR document.
(2) Repeated use of extensions, either on the same aeroplane or on similar aeroplanes in an
operator’s fleet, should not be used as a substitute for good management practices. Short-term
extensions must not be used for fleet CMR escalation.
(3) The CMR document should state that the Agency must approve, prior to its use, any desired
extension not explicitly listed in the CMR document.
Any post-certification changes to CMRs should be reviewed by the CMCC, and must be approved by
the Agency, which approved the type design.
a. Since the purpose of a CMR is to limit the exposure time to a given significant latent failure as
part of an engineering analysis of overall system reliability, instances of a CMR task repeatedly finding
that no failure has occurred may not be sufficient justification for deleting the task or increasing the
time between repetitive performances of the CMR task. In general, One Star CMRs are not good
candidates for escalation under an operator’s reliability programme. A One Star CMR task change or
interval escalation could only be made if world fleet service experience indicates that certain
assumptions regarding component failure rates made early during the engineering analysis were overly
conservative, and a re-calculation of system reliability with revised failure rates of certain components
reveals that the task or interval may be changed.
b. The introduction of a new CMR or any change to an existing CMR should be reviewed by the
same process used during initial certification. It is important that operators be afforded the same
opportunity to participate they received during the original certification of the aeroplane, in order to
allow the operators to manage their own maintenance programmes.
c. In the event that later data provide sufficient basis for a relaxation of a CMR (less restrictive
actions to be required), the change may be documented by a EASA-approved change to the CMR
document.
e. After initial aeroplane certification, the only basis for adding a new CMR is in association with
certification of design changes.
f. A new CMR created as part of a design change should be a part of the approved data for that
change, and added to the CMR document.
2-GEN–34
BOOK 2 CS-25
APPENDIX 1
GUIDANCE FOR USE OF CMRs
2-GEN–35
CS-25 BOOK 2
The underlying goal of any system design should be an absolute minimum number of CMRs, with none
as the goal. However the final determination of system design, and ultimately the number of CMRs,
after safety and reliability are assured, should be based on the total cost of ownership of the system (or
the aeroplane), with due regard to weight, reliability, initial and recurring costs. If the cost of adding
practical and reliable monitoring and/or warning to a system is large, and the added maintenance
burden of a CMR is small, addition of a CMR may be the solution of choice for both the type certificate
applicant and the operator.
A decision to create a CMR should include a rigorous trade-off of the cost, weight, or complexity of
providing an alerting mechanism or device that will expose the latent failure, versus the requirement for
the operator to conduct a maintenance or inspection task at fixed intervals. The following points should
be considered in any decision to create a CMR.
a. What is the magnitude of the changes to the system and/or aeroplane needed to add a reliable
monitoring or warning device that would expose the hidden failure? What is the cost in added system
complexity?
c. Is the monitoring and warning system reliable? False warnings must be considered as well as
a lack of warnings.
d. Does the monitoring or warning system itself need a CMR due to its latent failure potential?
e. Is the CMR task reasonable, considering all aspects of the failure condition that the task is
intended to address?
g. Is the proposed CMR task labour intensive or time consuming? Can it be done without having
to ‘gain access’ and/or without workstands? Without test equipment? Can the CMR task be done
without removing equipment from the aeroplane? Without having to re-adjust equipment? Without leak
checks and/or engine runs?
h. Can a simple visual inspection be used instead of a complex one? Can a simple operational
check suffice in lieu of a formal functional check against measured requirements?
i. Is there ‘added value’ to the proposed task (i.e. will the proposed task do more harm than good
if the aeroplane must be continually inspected)?
2-GEN–36